The Agent Skills Directory

[COMMAND_EXECUTION]: In SKILL.md, Step 3 provides the shell command ln -s ../../skills/<skill-name> .claude/skills/<skill-name>. The <skill-name> variable is interpolated directly into the shell string without double-quoting or sanitization, creating a surface for command injection if the input contains shell metacharacters like semicolons or pipes.\n- [COMMAND_EXECUTION]: The template file sample/SKILL.sample.md includes a reference to GIT_SSL_NO_VERIFY=1. Bypassing SSL/TLS verification is a security-harmful practice that exposes the system to Man-in-the-Middle (MitM) attacks.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted input (skill names and requirements) and interpolates this data into shell commands and subagent prompts without proper sanitization or boundary markers.\n
Ingestion points: The <skill-name> argument and user-provided requirements in SKILL.md.\n
Boundary markers: The delegation prompts to subagents do not utilize delimiters or specific instructions to ignore embedded directives in the user-supplied text.\n
Capability inventory: The skill executes shell commands (ln -s) and writes files (SKILL.md) to the local file system.\n
Sanitization: The instruction set lacks any validation, filtering, or escaping logic for external variables before they are used in sensitive contexts.

create-skill