The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute bash commands found in generated snippets during the 'scaffold' process. Specifically, step 5 ('Pre-flight the body's snippets') directs the agent to 'execute each bash line' and 'read each referenced path.' Because these snippets are part of a skill being created from user-provided names and descriptions, this pattern allows for the execution of commands derived from untrusted input.
[REMOTE_CODE_EXECUTION]: Step 5 of the 'scaffold' mode also instructs the agent to 'fetch each API endpoint' found in the generated snippets. This can lead to unauthorized network requests or the retrieval and potential execution of remote content based on the generated skill body.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing user-supplied input (name, description, category) to generate a new SKILL.md file. Because the skill subsequently executes snippets within that generated file, a malicious input could influence the generated commands, leading to injection attacks. There are no defined sanitization procedures or boundary markers for the user-supplied input.

newskill