The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill scans untrusted files in the repository, such as documentation and user-facing screens, which could contain malicious prompts. Combined with shell access, this poses a risk of the agent being manipulated by the data it processes.\n
Ingestion points: The skill reads files from the repository identified as surfaces, including docs-and-help, screens, and cli entry points as described in references/surface-inventory.md.\n
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the instructions to protect the agent from data-driven manipulation.\n
Capability inventory: The skill is granted Bash, Read, Write, Grep, and Glob capabilities to analyze the code and report findings.\n
Sanitization: The instructions do not specify any validation, filtering, or sanitization steps for the data retrieved from the codebase before it is processed by the LLM.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install additional dependencies from an external source, which involves executing remote code during the installation process.\n
Evidence: The file SKILL.md contains the instruction: Install the companions with npx skills add crissmoldovan/agent-skills.\n
Context: This refers to the author's own tools and represents standard vendor-provided functionality for this skill family.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute shell commands like git grep, git blame, and file hashing for its discovery logic. While necessary for the skill's UX discovery purpose, these commands are executed against untrusted codebase content, creating a potential vector for command injection if filenames or content are crafted maliciously.

new-ux-discovery