The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted data from the web to generate new AI agent skills, creating a significant attack surface for indirect instructions.
Ingestion points: The Research Agent, as defined in references/agent-prompts.md, utilizes tools like mcp__Ref__ref_read_url and WebFetch to ingest content from arbitrary external documentation sites.
Boundary markers: The agent prompts do not define explicit delimiters or boundary markers (such as XML tags) to isolate fetched content, nor do they instruct agents to ignore embedded instructions within the sourced data.
Capability inventory: The skill coordinates subagents via the Agent tool, writes files to the local filesystem, and executes shell commands for script initialization and packaging.
Sanitization: There is no evidence of sanitization or instruction-filtering for the data retrieved from external URLs before it is processed by the research or integration agents.
[COMMAND_EXECUTION]: The skill relies on the execution of local scripts to manage the lifecycle of the skill being created.
Evidence: SKILL.md documents the execution of plugins/plugin-creator/skills/skill-creator/scripts/init_skill.py for directory setup and plugins/plugin-creator/skills/skill-creator/scripts/package_skill.py for final validation and packaging.
[EXTERNAL_DOWNLOADS]: The workflow depends on fetching data from various external sources to populate the skill's reference documentation.
Evidence: references/mcp-tools.md details the usage of WebFetch, mcp__Ref__ref_read_url, and mcp__exa__web_search_exa to retrieve documentation and code examples from the internet.

skill-research-process