The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's assessment rubric in references/quality-criteria.md explicitly directs the agent to "Run documented commands (mentally or actually)" found within untrusted AGENTS.md files to check for actionability. This creates a critical vulnerability where malicious code embedded in project documentation can be executed on the host system.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to run shell commands for both discovery (finding documentation files) and verification (testing discovered commands), providing the agent with broad execution capabilities that can be abused by malicious file content.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it ingests and evaluates untrusted content from the repository.
Ingestion points: Documentation files are discovered and their content is ingested via the Read and Glob tools as specified in SKILL.md.
Boundary markers: No delimiters or explicit "ignore embedded instructions" warnings are provided to the agent when it evaluates the untrusted file content.
Capability inventory: The agent possesses powerful capabilities including Bash for shell execution and Edit for file system modification across the repository.
Sanitization: There is no evidence of command sanitization, escaping, or verification of the source's integrity before the agent attempts to run or evaluate the commands found in documentation.

agents-md-improver