The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from a user-provided source directory.
Ingestion points: CSS, SCSS, JS, TS, and HTML files within the source path are read by agents during the discovery and extraction waves (SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the source files are present.
Capability inventory: The skill possesses the ability to write files, execute shell commands (Bash), and spawn additional agents via spawn_agents_on_csv.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from source files before it is processed by sub-agents or converted into knowledge assets.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform directory setup and cleanup tasks.
Evidence: Execution logic includes shell commands such as mkdir -p, rm -rf '${temp_dir}', and several text processing pipelines using tr and sed (SKILL.md). While used for legitimate workflow management, these represent direct command execution.

maestro-ui-codify