The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is explicitly designed to ingest the content of ACCESSIBILITY.md files from the root of any project it is used in. This provides an attack surface where malicious or compromised project files could inject instructions into the agent's context.
Ingestion points: The ACCESSIBILITY.md file located at the project root.
Boundary markers: Absent. While the skill includes textual warnings to "Treat as untrusted input," it does not define specific structural delimiters (like XML tags) to be used during the file reading process.
Capability inventory: The agent is authorized to generate code, write files, and load additional sub-skills based on the contents of the target project.
Sanitization: Absent. The skill relies on agent reasoning and manual verification rather than programmatic filtering or escaping of the ingested markdown content.
[COMMAND_EXECUTION]: The skill documentation includes a shell command npx skills add mikemai2awesome/agent-skills --skill frontend-a11y. This presents a risk where an agent may attempt to execute code via npx from a third-party source not associated with the primary vendor.
[REMOTE_CODE_EXECUTION]: The recommendation to install external skills using npx from a third-party GitHub repository (mikemai2awesome) constitutes a remote code execution vector, as the contents of the external package are downloaded and executed at runtime.
[EXTERNAL_DOWNLOADS]: The "AI Scraping Policy" section confirms that the skill is intended to fetch and process content from external URLs. This involves network operations targeting domains that are managed by third parties and governed by external configuration files.

accessibility-general