The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's primary function is the automated generation of new SKILL.md files, which define the logic and capabilities for future AI agent tasks. This form of dynamic instruction generation is sensitive, as any failure to correctly generalize or sanitize the logic could result in a new skill that contains malicious patterns or security flaws derived from the task logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from SKILL_SOURCE_<id>.md files. 1. Ingestion point: The ## Action trace section of the source file is loaded via read_file. 2. Boundary markers: The skill does not employ explicit delimiters or instructions to ignore malicious directives within the trace data. 3. Capability inventory: The skill has the capability to perform write_file operations to the skills/ directory, allowing it to persist instruction-based payloads. 4. Sanitization: While the agent is instructed to 'generalize' the workflow, there is no programmatic validation or filtering of the content being processed. Malicious instructions hidden in a previous task's trace could influence the agent's generalization process, leading to the creation of a 'poisoned' skill.
[DATA_EXFILTRATION]: The skill reads detailed logs of past activities (SKILL_SOURCE_<id>.md) which may contain sensitive information like API keys, internal identifiers, or private data. While instructed to generalize, there is a risk that this sensitive context could be inadvertently persisted into the new SKILL.md file, which represents a form of internal data exposure.

craftbot-skill-creator