The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external improvement-plan-*.md files to drive automated Edit and Write operations.
Ingestion points: Reads and parses improvement-plan-{skill-name}.md files.
Boundary markers: The parsing logic relies on specific markdown headers (e.g., ## High Priority Improvements), but there are no instructions to ignore or sanitize Natural Language (NL) commands embedded within the suggested content blocks.
Capability inventory: The skill uses the Edit and Write tools to modify files and executes local shell scripts (backup-skill.sh, verify-update.sh) via the terminal.
Sanitization: The skill does not sanitize the suggested content before applying it to files, potentially allowing an attacker to inject malicious code or instructions into other skills.
[COMMAND_EXECUTION]: The skill executes local shell scripts to perform backups and verify updates. While these scripts are part of the skill's legitimate workflow, they represent an execution surface that relies on the integrity of the environment and the parameters passed to them (such as <skill-path>).

skill-improver