The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from both the user's intent ($ARGUMENTS) and a JSON payload containing fields like 'idea', 'useWhen', and 'description' to generate new skill instructions.
Ingestion points: SKILL.md interpolates $ARGUMENTS directly into the workflow context. The README.md explains that a JSON payload is read from /tmp/result.json and passed to the agent as additionalContext.
Boundary markers: There are no delimiters, XML tags, or "ignore embedded instructions" warnings present to isolate user-provided text from the skill's core logic.
Capability inventory: The skill is capable of writing new Markdown files (SKILL.md) to the local file system based on the processed input.
Sanitization: No sanitization, escaping, or validation of the user-provided strings is mentioned before they are used to generate the instructions for the new skill.
[DATA_EXFILTRATION]: The skill uses paths provided in the input JSON (marketplacePath, projectPath) to determine where to write new files, which presents a directory traversal risk.
Evidence: SKILL.md instructs the agent to write to paths like <marketplacePath>/plugins/<plugin>/skills/<name>/SKILL.md. If the input variables are manipulated (e.g., using ../ sequences), an attacker could potentially force the agent to overwrite sensitive files elsewhere on the system.
[COMMAND_EXECUTION]: The skill's documentation describes a workflow that involves executing a local shell script during the skill's lifecycle.
Evidence: README.md states that hooks.json runs scripts/launch-ai-tools-manager-app.sh. While this appears to be a legitimate vendor-provided tool, it represents a local execution capability tied to the skill's triggers.

create-skill