The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to audit and rewrite other agent skills, which involves ingesting untrusted markdown and script files. This creates an attack surface for indirect prompt injection where malicious instructions in a target skill could attempt to influence the agent's audit behavior.
Ingestion points: Files in the target directory being audited or improved, such as SKILL.md, reference files, and rules folders, as specified in Phase A: Read everything first of references/improving-existing-skills.md.
Boundary markers: The skill encourages a structured audit process and provides a validate.sh script to enforce mechanical gates, though the manual rewrite phase relies on the agent's interpretation of external text.
Capability inventory: The skill uses a local bash validation script (validate.sh) that executes subprocesses (Ruby, Perl, shell utilities) to inspect file content. It also documentation the use of !command shell injection and allowed-tools for broader tool access in the skills it helps create.
Sanitization: The validate.sh script uses YAML.safe_load and JSON.parse to safely handle structured metadata, and performs static analysis using regular expressions rather than executing the logic of audited files.

agent-skills-creator