The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates instructions from external files (references/agents-md-setup.md) found within subdirectories in the skills/ folder. This creates a surface where a malicious skill could inject arbitrary instructions into the project's central AGENTS.md file.
Ingestion points: skills/*/references/agents-md-setup.md (read in Step 7 of SKILL.md).
Boundary markers: The content is wrapped in  markers, which aids in management but does not prevent the processing of malicious instructions by the agent.
Capability inventory: The skill can write to critical instruction files (AGENTS.md, CLAUDE.md, .cursor/rules) and recommends executing external commands via npx.
Sanitization: There is no evidence of content validation or sanitization for the markdown snippets aggregated from the skill directories.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! syntax in SKILL.md to execute shell commands at load time for environment and capability detection.
Evidence: SKILL.md executes test, git rev-parse, ls, sed, and a for loop to scan the local filesystem for project metadata and installed skills.
Context: These commands are used to identify the programming language and harness type to tailor recommendations. They are local to the project directory and perform benign checks.
[COMMAND_EXECUTION]: The skill recommends the execution of npx commands to the user for installing additional project management skills from the author's repository.
Evidence: npx skills add jwilger/agent-skills --skill ... is suggested in references/skill-recommendations.md.
[EXTERNAL_DOWNLOADS]: The skill recommends fetching external dependencies from the author's repository (jwilger/agent-skills) using the npx package runner. The resource is identified as a vendor-owned resource for the author jwilger.

bootstrap