The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes scripts that execute shell commands to perform maintenance and visualization tasks. scripts/update-sources.sh uses curl and git clone to synchronize content from external repositories. sources/obra/render-graphs.js uses execSync to run the Graphviz dot utility on content extracted from Markdown files.
[EXTERNAL_DOWNLOADS]: The maintenance script scripts/update-sources.sh fetches content from several GitHub repositories, including those belonging to individual developers (EveryInc, obra, pproenca), and from the agentskills.io domain. These sources provide the instructional content vendored within the skill.
[PROMPT_INJECTION]: The skill contains educational material in the sources/obra/ directory that uses "pressure scenarios" to test agent compliance. These scenarios employ techniques such as authority framing and artificial urgency (e.g., "IMPORTANT: This is a real scenario. Choose and act."), which resemble patterns used in prompt injection attacks.
[INDIRECT_PROMPT_INJECTION]: The synthesis workflow described in workflows/synthesize.md involves ingesting data from various external sources like documentation, git logs, and issue threads. This ingestion process creates a surface for potential indirect prompt injection if the sources contain malicious instructions.
[DYNAMIC_CONTEXT_INJECTION]: The skill provides documentation on the risks associated with dynamic context execution (! syntax) and file references (@ syntax) in agent environments, offering specific instructions to authors on how to prevent unintended execution (sources/everyinc/references/common-patterns.md).

skill-authoring