The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied information to generate executable slash commands, which are then stored as persistent markdown files.
Ingestion points: User input provided during Step 3 (Gather Command Information) in SKILL.md, including command name, purpose, and detailed workflow steps.
Boundary markers: The skill uses a structured markdown template (frontmatter + markdown sections) as defined in references/best-practices.md, but it lacks explicit instructions to sanitize or escape the content of the workflow steps to prevent malicious instructions from being embedded in the generated command.
Capability inventory: The skill uses the Write tool to persist commands to the file system and the Bash tool to create directories (mkdir -p). The commands it generates are intended to use high-privilege tools like Bash and Task (subagents) for autonomous execution.
Sanitization: While the skill enforces a kebab-case naming convention for the command filename, it does not validate or filter the logic/instructions provided by the user for the workflow steps, allowing for the creation of commands with potentially dangerous payloads.
[COMMAND_EXECUTION]: The skill uses local shell commands to manage the environment and determine location context.
Evidence: SKILL.md invokes git rev-parse --is-inside-work-tree to detect if the current directory is a repository and mkdir -p to ensure the command storage directories exist. These are standard operations for development tooling but involve direct subprocess execution.

command-creator