The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: It reads task files (provided via task_file_path), design specifications, and various source files (SKILL.md, agents) as inputs for refactoring tasks.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within these external files.
Capability inventory: The skill has extensive capabilities, including creating new directories and files, editing existing files (like plugin.json), deleting files, and executing shell commands (uvx).
Sanitization: No sanitization or validation of the content read from external task files is performed before it is used to drive agent actions.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute uvx skilllint@latest check <skill-path>. The uvx tool fetches and runs the latest version of the skilllint package from a remote registry (PyPI) at runtime to perform quality checks.
[COMMAND_EXECUTION]: The skill performs various file system operations and executes the uvx utility to lint generated content. It also includes logic for modifying plugin.json, which is a sensitive configuration file that controls plugin behavior and tool discovery.

start-refactor-task