The Agent Skills Directory

[PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted external data (URLs, PDFs, documents), making it a target for indirect prompt injection attacks.
Ingestion points: references/source-ingestion.md provides instructions for browsing URLs and extracting content from local files such as PDFs, EPUBs, and Word documents to build a 'Source Inventory'.
Boundary markers: The workflow lacks explicit boundary markers or system-level instructions to ignore malicious directives that might be embedded within the source materials being processed.
Capability inventory: The skill possesses the ability to execute shell commands (ruby, find, diff) for quality assurance, which could be exploited if an injection influences the file paths or metadata being verified.
Sanitization: No explicit sanitization, validation, or escaping of source content is documented before it is transformed into executable 'workflows' or 'checks' in the generated skill files.
[COMMAND_EXECUTION]: The skill includes instructions to perform local command-line operations to verify the integrity and correctness of its outputs.
Evidence: In references/quality-gates.md, the skill instructs the use of ruby -ryaml -e 'p YAML.load_file(ARGV[0])["name"]' /path/to/SKILL.md to validate frontmatter parsing. It also uses find to verify the file tree and diff -qr to ensure mirrored skill directories are consistent.

source-to-skill-tree