The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as mkdir -p and git mv using directory names extracted from a user-provided plan. The lack of instructions to sanitize these names creates a risk that shell metacharacters (e.g., backticks, semicolons) in the plan could trigger unintended command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a user-provided list of exercises to automate file system and version control operations.
Ingestion points: The user-provided "plan" mentioned in the workflow steps of SKILL.md.
Boundary markers: The instructions do not define delimiters or specific "ignore instruction" warnings to isolate the input plan from the skill's logic.
Capability inventory: The skill uses shell execution for directory management (mkdir) and version control (git), and performs file writes for readme.md files.
Sanitization: There are no instructions for the agent to validate, escape, or sanitize the names extracted from the user plan before interpolating them into shell commands.

scaffold-exercises