The Agent Skills Directory

[PROMPT_INJECTION]: The skill directly interpolates user-supplied input into the agent's context using the $ARGUMENTS placeholder in SKILL.md. An attacker providing malicious arguments could attempt to override agent instructions.
[PROMPT_INJECTION]: The skill processes untrusted external data from project files such as README.md and chapters/*.md which constitutes an indirect prompt injection surface.
Ingestion points: Title, Author, and Description are extracted from README.md; chapter content is read from all markdown files in the chapters/ directory.
Boundary markers: Absent. There are no clear delimiters or instructions to the agent to ignore potentially malicious content inside these files.
Capability inventory: The agent executes shell commands via pandoc and open, and performs file writes to the builds/ directory and /tmp/.
Sanitization: Absent. There is no evidence of filtering or escaping the content extracted from the fiction project before it is used in command construction or reporting.
[COMMAND_EXECUTION]: The skill uses dynamic context injection (shell commands executed at load time) in SKILL.md to discover project status.
Evidence: !ls chapters/*.md 2>/dev/null | wc -l | tr -d ' ' and !ls covers/cover.* 2>/dev/null | head -1 || echo "no cover found".
Context: These are used for benign reporting of chapter counts and cover presence.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands involving pandoc and the open utility for file operations and system interaction.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends downloading and installing external software (pandoc) using the Homebrew package manager (brew install pandoc), which is a well-known and trusted service.

build