The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes uvx skills-ref validate, which triggers the download and execution of an external package from the Python Package Index (PyPI) at runtime.
[EXTERNAL_DOWNLOADS]: The use of uvx involves fetching remote packages from public registries. The package skills-ref is an external dependency not currently identified in the trusted vendor list.
[INDIRECT_PROMPT_INJECTION]: The skill processes external files (target skills for review) that may contain untrusted data.
Ingestion points: The contents of SKILL.md and reference files within the directory provided to the reviewer.
Boundary markers: The instructions do not specify explicit delimiters or isolation when the agent reads and processes the content of the skill under review.
Capability inventory (SKILL.md): The agent has access to tools including Bash, Write, Edit, Read, Glob, and Grep, which could be abused if the agent follows instructions hidden within a malicious skill being reviewed.
Sanitization: While the included scripts/quick_review.py script uses yaml.safe_load() for YAML parsing, the broader review process relies on the LLM's interpretation of the skill body content, which lacks specific sanitization for embedded instructions.

skill-reviewer