The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external data from URLs or local files (via the --source parameter) to update knowledge base pages. This creates an indirect prompt injection attack surface where malicious instructions embedded in those sources could influence the agent's actions during the curation process.
Ingestion points: In Step 3 of the workflow in SKILL.md, the skill reads the full content of the provided source.
Boundary markers: There are no instructions for using delimiters or warnings to ignore potential instructions within the ingested source data.
Capability inventory: The skill has access to Edit, Write, and Bash tools, which could be misused if an injection occurs.
Sanitization: No sanitization, filtering, or validation steps for the external content are described.
[COMMAND_EXECUTION]: The skill executes a local Python script using the Bash tool to manage configuration bindings. The execution involves parameters derived from user input.
Execution pattern: python3 ${CLAUDE_PLUGIN_ROOT}/scripts/knowledge-binding.py read --knowledge-root <knowledge_root>
Evidence: This execution is documented in Step 1 of the workflow in SKILL.md. The script is a local resource within the plugin directory.

knowledge-update