The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading user-supplied strings (such as the 'Scope note' and 'Controlled tag vocabulary') and writing them directly into a CLAUDE.md file or metadata/vocabulary.txt. These files are then used by the agent to determine behavior in subsequent sessions. An attacker-controlled media source could potentially include metadata designed to influence agent behavior when the workspace is cataloged.
Ingestion points: User prompts for 'Source path', 'Scope note', and 'Controlled tag vocabulary' (Step 6).
Boundary markers: Not explicitly defined in the generated markdown or text files.
Capability inventory: The skill uses mkdir, cp, git, and gh tools (Step 4, 7).
Sanitization: No explicit sanitization or escaping of the user-provided strings is mentioned before writing to the workspace files.
[COMMAND_EXECUTION]: The skill executes shell commands to scaffold the workspace and manage version control. While it uses $ARGUMENTS for naming, it uses standard tools like git and gh. The risk is minimized by the disable-model-invocation: true flag in the frontmatter, which prevents the model from generating arbitrary code during the execution of this specific skill.

new-workspace