The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of untrusted data from external sources. It crawls documentation sites, GitHub repositories, and changelogs based on user-provided arguments.
Ingestion points: WebFetch operations defined in SKILL.md (Workflow steps 1, 1b, and 1c) that retrieve content from arbitrary URLs and GitHub repositories.
Boundary markers: Absent. There are no instructions to the agent to treat fetched content as untrusted or to ignore embedded instructions.
Capability inventory: The skill has access to Bash, Write, Edit, Read, Glob, and Grep (as listed in the allowed-tools frontmatter).
Sanitization: Absent. The skill does not perform validation or escaping on the retrieved content before the agent processes it for feature extraction.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform GitHub API queries (gh api) and other system operations. While these are used for legitimate functionality, the presence of shell access in a skill that processes untrusted external data increases the potential impact of a prompt injection attack.
[EXTERNAL_DOWNLOADS]: The skill retrieves data from external documentation websites and GitHub's raw content infrastructure (raw.githubusercontent.com). These downloads are used to build the feature ledger and perform benchmarking analysis.

benchmark-praxis