The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the installation of upstream components using the command npx skills@latest add mattpocock/skills -s grilling,research,wait-what -y. This involves downloading and executing code from the npm registry and a third-party GitHub repository that is not on the verified sources list. While the instructions state that this action must be confirmed by the user, the execution of unverified code from an external source represents a significant code execution vector.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading existing workspace files, such as learner.md and look.md, and using their content to generate new assets like base.css and course.js. * Ingestion points: The agent reads configuration and history files (learner.md, look.md, AGENTS.md) from the course folder. * Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between data and potential instructions within these files. * Capability inventory: The skill is capable of writing multiple files to the local filesystem and executing shell commands via npx. * Sanitization: Content from local files is used directly to inform the generation of CSS and JavaScript without validation or escaping logic.

setup-faculty-skills