The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions define a 'Post-Write Validation Gate' that executes a Python script (kb_type_validate.py) from a directory path (<kb-start-scripts>) resolved at runtime. While the script belongs to the fe-knowledge-base vendor resource, the execution of code from dynamically computed paths is a noted execution pattern.
[COMMAND_EXECUTION]: The execution pipeline in SKILL.md includes shell commands to run the ga4_client.py utility and the validation script. These commands interpolate variables for property IDs, file paths, and JSON request bodies.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and analyzes data from the external GA4 API to generate a performance profile.
Ingestion points: External data from GA4 report responses (e.g., event names, page paths, landing pages) ingested during Steps 3 through 8.
Boundary markers: The skill specifies a structured output template (YAML and markdown sections) but does not define explicit delimiters or sanitization for the raw API data before it is processed by the agent.
Capability inventory: The skill has file-write capabilities (profile generation), network access (Google APIs), and local shell command execution.
Sanitization: No specific sanitization or filtering logic is provided to handle potentially malicious or unexpected strings returned by the analytics API before they are incorporated into the agent's context.

ga4-audit