The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bash script (update-readme.sh) that utilizes standard system utilities including find, awk, sed, and grep. These tools are used for local filesystem traversal, text parsing, and file manipulation within the repository's scope.
[DYNAMIC_EXECUTION]: The script invokes the Node.js runtime using node -e to execute a small, hardcoded JavaScript snippet. This snippet is used exclusively for parsing the local skills.sh.json file, which is a common pattern when sophisticated JSON processing is required in shell environments.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted metadata from various SKILL.md files to generate repository documentation.
Ingestion points: The script reads the name and description fields from the YAML frontmatter of all SKILL.md files located in the skills/ directory.
Boundary markers: None are present; the extracted metadata is directly interpolated into Markdown templates.
Capability inventory: The script performs file write operations (> redirection and mv) to update multiple README.md files throughout the repository.
Sanitization: The script performs minimal sanitization by escaping the pipe character (|) using sed to maintain the integrity of Markdown tables, but it does not filter other Markdown syntax or instructions that might be present in the skill descriptions.

do-update-readme