The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's ecosystem discovery mechanism (Phase 4) reads names and descriptions from local SKILL.md files and incorporates them directly into the generated rules sections. This creates a surface for indirect injection if an attacker-controlled skill is present on the local system.
Ingestion points: Phase 4 scanning of user-level and project-level directories for SKILL.md files.
Boundary markers: Absent; metadata is inserted as bulleted text under Markdown headers without specific escaping or boundary delimiters.
Capability inventory: Extensive file-writing capabilities to system and project configuration paths (e.g., ~/.claude/CLAUDE.md, .cursorrules).
Sanitization: Absent; the skill is designed to include metadata verbatim to ensure accurate skill referencing.
[INDIRECT_PROMPT_INJECTION]: The questionnaire process allows for the verbatim inclusion of user-provided build/run commands (Q13) and additional preferences (Q20) into the final instruction file.
Ingestion points: Phase 3 questionnaire responses for Q3 and Q20.
Boundary markers: Content is placed under ## Commands and ## Additional Rules headers but lacks specific sanitization.
Capability inventory: File writing to agent instruction paths.
Sanitization: Content is included verbatim as provided by the user.

agentic-rules-writer