The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting research findings that are later processed by the LLM-driven wiki-update tool. Maliciously crafted content within the research reports could attempt to influence the wiki update process.
Ingestion points: Research project reports (report.md) and sub-question data files (sq-*.md) are read during the workflow described in SKILL.md (Steps 0 and 4).
Boundary markers: The generated refresh files include descriptive headers and context notes, but they lack explicit delimiters or "ignore instructions" warnings to isolate the injected research findings.
Capability inventory: The skill can dispatch the wiki-update skill to modify the wiki and executes orchestration scripts via the Bash tool.
Sanitization: No explicit sanitization or escaping of research findings is performed before materialization.
Mitigation: A mandatory human-in-the-loop checkpoint (AskUserQuestion in Step 3) requires user approval of the match plan before any updates are executed.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute internal Python orchestration scripts (lint_wiki.py and refresh_planner.py). These scripts are used for staleness detection and match planning.
Evidence: Execution of python3 ${CLAUDE_PLUGIN_ROOT}/skills/wiki-lint/scripts/lint_wiki.py in the Workflow section of SKILL.md.
[COMMAND_EXECUTION]: The scripts/refresh_planner.py script performs dynamic module loading (Category 10) by modifying the Python path to import shared utilities from a sibling skill.
Evidence: sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "wiki-ingest" / "scripts")) is used to load _wikilib and _wiki_research modules.

wiki-refresh