The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions allow for accepting new pattern definitions mid-conversation. This ingestion surface lacks boundary markers, which could allow external data to indirectly inject new instructions or override existing agent behaviors during a session.
[INDIRECT_PROMPT_INJECTION]: The /json command supports custom schemas through user-provided keys. This creates a surface for schema confusion, where natural language instructions could be injected into data-structured outputs.
[COMMAND_EXECUTION]: The SPEC.md documentation references the use of local shell commands and Python scripts (e.g., distiller.py) for validation and trigger testing. While these are development tools, they represent an interface for local command execution.
[SAFE]: The skill specification explicitly forbids the storage of secrets, credentials, tokens, and machine-specific filesystem paths within the skill or its references, demonstrating good security hygiene.

meta-prompting