The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/skill-manager utility executes several shell commands to manage files and directories, including mkdir, cat, rm, and chmod. These commands are used to scaffold new skill structures and maintain the local environment.
[REMOTE_CODE_EXECUTION]: The install command in scripts/skill-manager delegates to npx skills add, which fetches and executes the skills package from the npm registry. This represents a remote code execution vector typical of package management tools but poses a risk if the package is untrusted or compromised.
[PRIVILEGE_ESCALATION]: When creating new skills, scripts/skill-manager automatically applies chmod +x to newly generated scripts in the scripts/ directory, elevating their permissions to executable status.
[DYNAMIC_EXECUTION]: The validate command in scripts/skill-manager executes scripts (specifically testing for --help support) to ensure compliance with repository conventions. It also generates new shell scripts from templates at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and manage external skill definitions from marketplaces (e.g., skillsmp.com) and GitHub repositories, which is a significant attack surface for indirect prompt injection.
Ingestion points: references/finding-skills.md and scripts/skill-manager provide workflows for searching and installing skills from arbitrary external sources.
Boundary markers: The automation scripts do not include programmatic boundary markers, but the documentation in references/finding-skills.md provides a manual security audit checklist for users.
Capability inventory: The skill has full capability to write files, modify permissions, delete skill directories, and execute remote code via Node.js package runners.
Sanitization: The management script validates naming conventions using a kebab-case regex but does not perform content sanitization on installed skills.

skills-management