The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to create a new directory using the Bash tool with the command mkdir -p philosopher/skills/<name>. This pattern is vulnerable to command injection if the agent does not sanitize or escape shell metacharacters (such as ;, &, or |) in the user-provided <name> argument before execution.
[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by using user-supplied input to generate agent instruction files (SKILL.md and reference.md). Evidence: (1) Ingestion points: the <name> and --focus arguments in SKILL.md; (2) Boundary markers: absent in the generation logic; (3) Capability inventory: access to Bash and Write tools; (4) Sanitization: none specified beyond a manual user review step. This could be exploited to generate malicious skills if the generator is successfully manipulated.

create