The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands including git, mkdir, ln, and find to manage file structures and version control within the user's environment.
[COMMAND_EXECUTION]: The skill requires running a local Python script check-skills.py (located in ~/ghq/github.com/efoo-team/skills/scripts/) to perform linting and verification of the generated skill files.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx skills to download and install skill packages from remote repositories. While the instructions include a requirement for the agent to audit the source before execution, this mechanism inherently involves remote code execution.
[PROMPT_INJECTION]: In the 'Handling of additional instructions' (追加指示の扱い) section of SKILL.md, the agent is instructed to prioritize user-provided arguments over the skill's own internal policies. While it contains some logical guardrails, this pattern could be exploited to bypass intended safety or validation steps.
[INDIRECT_PROMPT_INJECTION]: As a meta-authoring tool, the skill's primary function is to ingest arbitrary user input and interpolate it into new instruction files (SKILL.md). This creates a vulnerability where malicious user input could result in the generation of compromised skills that contain hidden prompt injections.
Ingestion points: User-provided arguments (引数) and responses during the Phase 1 interview process.
Boundary markers: None specified for the generation of the output SKILL.md content.
Capability inventory: File writes, shell execution (git, mkdir, ln), and remote downloads/execution via npx.
Sanitization: No explicit sanitization or escaping of the user-provided strings before they are written into the new skill files.

create-skill