The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from session history and user input to generate or update instructions. This creates a surface where malicious instructions encountered during a task could be persisted into the skill library as durable procedures.
Ingestion points: The skill reads from session interactions and recent memory/ files as stated in the 'When to run' section.
Boundary markers: The skill employs process-level boundaries such as mandatory 'dry-run' diffs and explicit user confirmation before writing, but lacks technical delimiters or markers to separate untrusted session data from the new instruction content.
Capability inventory: The skill has write access to the local file system, specifically modifying SKILL.md, creating files in the scripts/ directory, and creating new skill folders as documented in the 'Write' and 'Sidecar Offload' sections.
Sanitization: No technical sanitization of ingested text is present; instead, the skill relies on manual review and agent self-verification steps described in the 'Verify' section.
[DYNAMIC_EXECUTION]: The skill facilitates the generation of new executable Python scripts from captured workflows.
Evidence: The 'Sidecar Offload' section instructs the agent to extract code blocks exceeding 20 lines into new files within the scripts/ directory.
[COMMAND_EXECUTION]: The skill utilizes shell commands for environment validation and searching the skill library for duplicates.
Evidence: The instructions include the use of nvidia-smi to verify GPU drivers in 'Prerequisites' and grep -rE to search for duplicate concepts across existing skill files in the 'Duplication check' section.

skill-distillation