The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a configuration framework that interpolates external data—such as repository names, branch names, and user-supplied arguments—into shell command templates. This creates an attack surface where malicious metadata from a repository could lead to command injection if the user does not follow the skill's recommendation to use shell quoting (| shq).
Ingestion points: Repository metadata (Owner, Repo, Path) and user arguments (.Args) ingested into config.yaml (documented in SKILL.md and references/spawn-patterns.md).
Boundary markers: The documentation recommends using the | shq pipe for shell quoting, but this is a user-implemented safeguard rather than a hard boundary.
Capability inventory: The skill enables arbitrary shell command execution (sh fields) and file copying (copy field) across all configuration files.
Sanitization: Mentions safe shell quoting via templates, but relies on correct user implementation.
[COMMAND_EXECUTION]: The skill includes numerous examples of shell commands intended to be defined in a configuration file and executed by the environment manager, including package management (npm install), build scripts (make), and terminal automation (tmux, osascript).
Evidence: Found in SKILL.md under usercommands and references/spawn-patterns.md under Legacy Spawn Commands.

config