The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to bypass user confirmation for specific automated sub-tasks, reducing user oversight.
Evidence: In SKILL.md, instructions include 'Carry this target and mode through a nested prose pass without another approval prompt' and 'It adds no approval stage; skip redundant passes over short status text.'
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell commands executed at load time to gather environmental context.
Evidence: SKILL.md uses the ! syntax to execute git rev-parse, wc, jq, and ls. These commands populate the skill's context with repository names, line counts, and directory structures. The hardcoded commands are benign; however, the presence of $ARGUMENTS in the same file creates a potential template injection surface if the platform does not sanitize user input before interpolation into a dynamic-execution-enabled file.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where malicious instructions embedded in a project's README or manifest could influence agent behavior.
Ingestion points: The skill reads README.md and package.json using the Read tool.
Boundary markers: There are no explicit instructions or delimiters to prevent the agent from following directions contained within the data files it processes.
Capability inventory: The skill is authorized to use Write, Edit, and Bash tools, which could be abused if the agent is manipulated by input data.
Sanitization: The skill does not perform validation on the content of the repository files before processing them.

write-clear-readme