The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It processes the content of existing skills in the user's workspace (untrusted data) and passes this content to LLM subagents (judges) for evaluation. Malicious instructions embedded in the file being refactored could potentially influence the judges' verdicts or subvert the agent's logic during the refactor process.
Ingestion points: Reads SKILL.md and related files from target skills in the local workspace.
Boundary markers: The protocol for the multi-judge ensemble (detailed in references/multi-judge-ensemble.md) does not specify robust delimiters (like XML tags or specific 'ignore' instructions) when interpolating target skill content into the judge prompts.
Capability inventory: Spawns subagents (Task tool), executes local Python scripts, and performs git operations (git commit, git revert).
Sanitization: No evidence of sanitization or escaping of the target skill's content before it is passed to LLM judges.
[COMMAND_EXECUTION]: The skill executes local shell commands and Python scripts as part of its core logic.
Git Operations: Uses git commit to save successful refactors and git revert to roll back changes that fail the equivalence or token-reduction gates.
Script Execution: Runs bundled Python scripts (scripts/equivalence_check.py, scripts/multi_judge.py, scripts/golden_compare.py) for structural comparison and consensus aggregation. These scripts use only standard Python libraries (argparse, json, re, sys, pathlib).

skill-refactor