The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the dynamic context syntax (!command) to execute shell scripts whenever the skill is loaded by the agent. The embedded script attempts to execute a table-of-contents utility from the environment or a hardcoded path within the user's home directory (~/.claude/skills/plugin-utils/bin/skill-toc).
[DYNAMIC_EXECUTION]: The script scripts/de_ai_audit.py utilizes importlib.util to dynamically load and execute prose-audit.py from a relative path (../../../scripts/prose-audit.py) outside of the skill's own directory. This allows the skill to execute arbitrary code located in the broader plugin structure.
[EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to install lxml and pyyaml at runtime via the shebang in scripts/de_ai_audit.py and instructions in SKILL.md. These dependencies are not pinned to specific versions, posing a potential supply chain risk if public registries are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and rewrite user-supplied prose drafts. Malicious instructions hidden within the input text could potentially influence the agent's behavior during the revision process.
Ingestion points: Target text files are read and passed to the audit script and the LLM for editing.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the input text as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has access to Read, Edit, Write, Bash, Grep, and Glob tools, which could be abused if an injection is successful.
Sanitization: The skill does not perform any sanitization or escaping of the input text before processing.

de-ai-revise