The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The 'Learn Mode' feature ingests content from external URLs to generate new skill instructions.
Ingestion points: URLs provided as arguments in references/LEARN-MODE.md which are fetched via WebFetch.
Boundary markers (absent): The fetch prompt does not explicitly define delimiters to isolate external content during the initial extraction phase.
Capability inventory: The skill uses Bash (for installation/removal) and Write (for generating skill files).
Sanitization (present): The skill implements a mandatory 'AUTO-SCAN' workflow (in SKILL.md and references/LEARN-MODE.md) that runs the security scanner on the generated skill to detect any leaked malicious instructions.
[COMMAND_EXECUTION]: The skill uses subprocess.run and Bash to execute internal utility scripts.
Evidence: scripts/cleanup-blocked-skill.py uses subprocess.run to call npx skills remove. The input skill name is validated to prevent command injection.
Evidence: SKILL.md defines workflows for running security-scan.py and validate.sh via Bash commands.
[EXTERNAL_DOWNLOADS]: The skill connects to external domains for search and learning functionality.
Evidence: scripts/search-skills.py makes HTTP requests to skills.sh to retrieve skill data.
Evidence: Learn Mode fetches documentation from user-supplied URLs using WebFetch.
[PROMPT_INJECTION]: The skill documentation and scanning scripts contain numerous prompt injection patterns (e.g., 'ignore previous instructions', 'do not tell the user').
Evidence: These patterns are located in scripts/security-scan.py as regex detection rules and in references/SECURITY-SCANNING.md as documentation examples. They are part of the skill's security logic rather than malicious attempts to override behavior.

aif-skill-generator