The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a form payload (fields like name, description, ownerName, etc.) and interpolates these values directly into the content of generated files such as marketplace.json, README.md, and CLAUDE.md.
Ingestion points: The form payload is read from /tmp/result.json and processed in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore potentially malicious content within these fields.
Capability inventory: The skill possesses the ability to create directories and write files to the local file system.
Sanitization: No sanitization or validation of the input strings is mentioned, allowing for potential injection attacks if the generated files are later read by an agent.
[CREDENTIALS_UNSAFE]: The skill's instructions explicitly reference and guide the management of sensitive authentication tokens, including GITHUB_TOKEN, GH_TOKEN, GITLAB_TOKEN, and BITBUCKET_TOKEN. While these are standard for private repository access, the skill encourages their proliferation in environment variables.
[PERSISTENCE]: In step 6 of SKILL.md, the instructions guide the user to add these sensitive environment variables to shell startup files like .bashrc and .zshrc. This creates a persistence mechanism for credentials that could be exploited by other malicious processes or skills accessing the user's environment.
[COMMAND_EXECUTION]: The skill performs directory creation and file writing based on a targetDir argument. The analysis indicates a lack of path validation, which could allow for path traversal or the overwriting of sensitive system or configuration files if the targetDir is set to an unintended location.

create-marketplace