The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze third-party skill directories which contain natural language instructions. This creates an attack surface where a malicious third-party skill could attempt to override the agent's behavior during the review process.
Ingestion points: The skill reads all files within the .agents/skills/<name>/ directory, including the SKILL.md instruction file.
Boundary markers: The instructions do not define specific delimiters or security headers to separate the untrusted third-party content from the agent's primary instructions.
Capability inventory: The agent has access to local shell utilities like git, find, and perl, and is instructed to run a local script named scripts/sync-skills.
Sanitization: No explicit sanitization or filtering of the third-party text is performed before the agent reads it.
[COMMAND_EXECUTION]: The skill relies on executing local system commands to perform its audit tasks.
Evidence: The instructions direct the agent to run git diff to identify changes in the lockfile, a complex find and perl pipeline to detect hidden characters (obfuscation), and a project-local script scripts/sync-skills --dry-run to verify directory layout. While these are standard tools for the stated purpose, they involve executing logic based on workspace file contents.

review-3p-skill