The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection in the YAML frontmatter to execute shell commands (echo, cat, tr, head) when the skill is loaded. These commands access files such as production/stage.txt and production/session-state/active.md to display the 'Live Project State'. While the commands are used for legitimate project tracking and are hardcoded to specific paths, they represent a mechanism that runs code silently before user interaction.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret data from several external project files which could potentially contain untrusted content.
Ingestion points: The skill reads ../../docs/workflow-catalog.yaml, production/stage.txt, production/session-state/active.md, and scans other plugin directories for SKILL.md files.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions that might be embedded within the project files it reads.
Capability inventory: The skill is restricted to the Read, Glob, and Grep tools, which limits the potential impact of an injection attack as the skill cannot write files or execute arbitrary shell commands through the AI agent interface.
Sanitization: The instructions do not define any sanitization or validation steps for the content extracted from the project artifacts.

help