The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes instructions to download and install an external skill from a non-trusted third-party repository using automated flags.
Evidence: In SKILL.md, the agent is directed to install the technical-writer skill using the command npx skills add https://github.com/shubhamsaboo/awesome-llm-apps --skill technical-writer -g -y. The use of the -y flag bypasses confirmation prompts for installing code from an untrusted source.
[PERSISTENCE]: The skill provides templates and samples that instruct the modification of the user's shell profile to maintain access or environment hooks.
Evidence: The file references/samples/README.md provides instructions to append code to the shell profile: echo "eval \"\$(direnv hook bash)\"" >> ~/.bashrc. This establishes a persistent hook that executes code whenever a new shell session is started.
[CREDENTIALS_UNSAFE]: The skill is designed to read and verify the contents of sensitive configuration files that typically contain secrets and credentials.
Evidence: SKILL.md instructs the agent to "Verify the codebase, configuration settings (e.g. config.py, Makefile, *.tfvars, pyproject.toml), environment variable names... before updating documentation." Files such as .tfvars and .env (mentioned in samples) are classified as sensitive file paths that may expose credentials.
[COMMAND_EXECUTION]: The instructions involve executing powerful system commands for identity and access management and service configuration.
Evidence: The documentation templates in references/samples/README.md include gcloud commands to modify IAM policy bindings (gcloud iam service-accounts add-iam-policy-binding) and enable cloud services, which could be misused to escalate privileges if not carefully reviewed by a user.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface by ingesting untrusted data from the codebase it is documenting without clear boundary markers or sanitization.
Ingestion points: The agent reads project files including conductor/tech-stack.md, config.py, Makefile, *.tfvars, pyproject.toml, and .env files to synchronize documentation.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious embedded commands within these project files.
Capability inventory: The agent has the capability to write files across the repository and execute shell commands via npx and gcloud.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the configuration files before it is processed or used in documentation generation.

maintaining-core-documentation