The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided workflow steps and descriptions to generate slash command files, which are then saved to the local file system. This creates a surface where an attacker could provide malicious instructions that are persisted and executed by the agent in future sessions. 1. Ingestion points: User input gathered in Step 3 ("Gather Command Information") of SKILL.md. 2. Boundary markers: The skill uses a markdown template to structure the output but lacks explicit validation or escaping of user input to prevent instruction injection within the generated file. 3. Capability inventory: The skill uses mkdir (Bash) and the Write tool to create directories and files in .claude/commands/ or ~/.claude/commands/. 4. Sanitization: No sanitization is performed on the user-provided text before it is interpolated into the final command file.
[DYNAMIC_EXECUTION]: The skill generates script-like markdown files from user input and templates. These files are intended to be interpreted and executed by the agent as slash commands. Evidence: Step 5 in SKILL.md describes writing the generated command to disk for future invocation via the /command-name syntax.

command-creator