The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the session history to generate persistent skill definitions in SKILL.md for future sessions.\n
Ingestion points: The agent's session context and user-provided instructions are used to construct the logic and descriptions of new skill files in SKILL.md.\n
Capability inventory: The skill possesses the Write, Edit, and Bash(uv run python*) tools, enabling it to create, modify, and execute scripts or instructions based on the extracted content.\n
Boundary markers: The instructions do not explicitly mandate the use of delimiters or 'ignore embedded instructions' warnings when interpolating extracted session content into the new skill's prompt body.\n
Sanitization: While a validation script (scripts/validate_skill.py) is provided, it focuses on structural integrity (YAML frontmatter, naming conventions, and regex checks) and does not sanitize the generated prompt content for potential malicious fragments that could influence future sessions.\n- [COMMAND_EXECUTION]: The skill uses local shell commands to manage the lifecycle of newly created skills.\n
Evidence: Phase 5 in SKILL.md instructs the agent to execute uv run python to run the included validation script (scripts/validate_skill.py) against the new skill directory.\n
Evidence: Phase 6 in SKILL.md instructs the agent to use cp -r to deploy the new skill directory to the final skills root path.

skill-extract