The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/scaffold.py script uses subprocess.run to execute pixi run validate. This is intended to verify the integrity of the registry.yaml file after the script appends a new entry. The command is called with a fixed list of arguments, which prevents shell command injection.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the scaffolding process. The scripts/scaffold.py script takes user-supplied strings for the description and license fields and interpolates them directly into YAML frontmatter and registry.yaml using double quotes.
Ingestion points: User input provided via the agent to scaffold.py arguments --description and --license.
Boundary markers: The script places user input inside double quotes within YAML fields but does not use a robust YAML library for writing, nor does it escape double quotes or control characters.
Capability inventory: The script has file write access to the skills/ directory and registry.yaml, and executes the pixi validator via subprocess.run (found in scripts/scaffold.py).
Sanitization: There is no character-level sanitization or escaping for YAML special characters in the description or license fields. A malicious user could provide a string like My description"\n malicious_field: true to inject unexpected fields into the skill's metadata.

sciagent-skill-creator