The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes and modifies external skill files provided as input, creating an attack surface where a malicious skill being refined could contain instructions targeting the refiner agent.
Ingestion points: Target skill directory and files (e.g., SKILL.md) specified via command arguments during the diagnostic phase.
Boundary markers: The skill lacks explicit instructions or delimiters to isolate the content of the target skill from the agent's own execution logic.
Capability inventory: The skill is capable of file-system writes (modifying skills) and command execution (verifying commands in /bin/bash as specified in rules/anti-aigc.md).
Sanitization: No explicit sanitization, filtering, or escaping of the ingested skill content is described in the diagnostic or improvement rules.
[COMMAND_EXECUTION]: The instructions in rules/anti-aigc.md explicitly direct the agent to verify command execution using /bin/bash. This functional requirement allows for the execution of arbitrary commands found within the target skills during the verification process.
[DYNAMIC_EXECUTION]: The refinement workflow involves generating improvement plans and programmatically modifying existing skill documentation or creating new rule files based on those plans. This dynamic creation and modification of local skill content is a core feature of the tool.

skill-refiner