The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function is to transform session context (messages, constraints, and corrections) into a persistent SKILL.md file. It explicitly instructs the agent to 'Preserve user corrections as hard rules', which could lead to the operationalization of malicious instructions if the session history is influenced by an attacker. 1. Ingestion points: Session context extracted during the analysis phase in SKILL.md. 2. Boundary markers: Absent. No specific delimiters or instructions are provided to prevent the agent from obeying instructions embedded in the session history. 3. Capability inventory: The skill can write files to the local filesystem and execute shell commands (python3, bash, ./bin/ask) as part of its validation workflow. 4. Sanitization: While the skill includes a general instruction to redact secrets and sensitive personal data, it lacks specific sanitization logic to prevent the inclusion of executable prompt injection patterns in the generated output. Additionally, the references/evals.yaml file contains benign test cases (e.g., 'ignore previous instructions') used for safety evaluation which may trigger static detectors but do not affect the skill's operational safety.
[COMMAND_EXECUTION]: The Validation section in SKILL.md directs the agent to execute several shell commands, including python3, bash, and a local binary ./bin/ask. These commands run scripts (e.g., scripts/validate_skill_authoring_family.sh) and tools that are not provided within the skill's own file list, suggesting a dependency on the host environment's pre-installed tooling.

skillify