The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to process files and check status, including git status --porcelain to verify a clean working tree and wc -w to analyze file sizes.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external URLs listed in documentation citations and uses git clone to download remote repositories identified via web searches to obtain source material for updates.
[REMOTE_CODE_EXECUTION]: The pipeline uses uvx skilllint@latest to run a Python-based linting tool directly from a package registry. This executes remote code at runtime and introduces a dependency on the package's integrity and versioning.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of ingesting and processing untrusted external data to modify its own instructions.
Ingestion points: The skill reads content from arbitrary URLs extracted from SOURCE: citations, results from exa web searches, and files from cloned Git repositories.
Boundary markers: The documentation of the synthesis and write stages does not specify the use of clear delimiters or instructions for the agent to ignore potential commands embedded within the fetched documentation content.
Capability inventory: The skill possesses the capability to modify local files (SKILL.md and reference files) and execute shell commands (uvx, git), which could be abused if malicious instructions are injected.
Sanitization: There is no evidence of sanitization, instruction filtering, or validation of the semantic content fetched from external sources before it is used to generate a change plan.

skill-sync