The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from untrusted external sources, creating an attack surface where malicious content could override agent instructions. The agent is directed to "Read its complete SKILL.md and repository instructions" from a third-party repository.
Ingestion points: External SKILL.md files and repository instructions from arbitrary owner/repository targets.
Boundary markers: None. The instructions do not define delimiters or provide warnings to the agent to treat external content as untrusted data.
Capability inventory: Shell command execution (pnpm, python), file system modifications (recipe and image generation), and Git operations (branching, committing, and opening Pull Requests).
Sanitization: No sanitization or validation of the natural language content within the external SKILL.md is specified before the agent processes it.
[COMMAND_EXECUTION]: The skill requires the execution of several local shell commands to perform its tasks. These include pnpm typecheck, pnpm build, and scripts/generate-og-image.py. While these commands are part of the vendor's official repository infrastructure, their execution path and the data they process are influenced by the metadata extracted from the external, untrusted repositories.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to fetch external content. It retrieves public SKILL.md files from third-party GitHub repositories for validation and catalog inclusion. Additionally, the skill mentions npx skills, which involves fetching and executing a utility from a remote package registry.

submit-package-skill