The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to generate persistent agent instructions (slash commands), creating a vulnerability surface where malicious instructions or path traversal attempts could be embedded into the agent's environment.\n
Ingestion points: User-provided strings for "Command Name", "Purpose", "Arguments", and "Workflow Steps" (SKILL.md, Step 3).\n
Boundary markers: None. The instructions do not warn the agent to treat user-provided workflow steps as untrusted or to delimit them from the command template instructions.\n
Capability inventory: The skill uses the Write tool to create new markdown files in project-level (.claude/commands/) or global (~/.claude/commands/) directories (SKILL.md, Step 5).\n
Sanitization: Absent. There is no technical validation to prevent path traversal (e.g., names containing ../) beyond a naming recommendation, and no sanitization of the generated instruction content to prevent the creation of malicious automated tasks.\n- [PERSISTENCE]: The skill facilitates the creation of global commands in ~/.claude/commands/, which adds permanent new capabilities to the agent's environment that persist across different projects and sessions.\n- [DYNAMIC_EXECUTION]: The primary purpose of the skill is the generation of executable instructions (markdown slash commands) for future autonomous execution by the agent. This represents a "code generation" capability for internal agent workflows.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands such as mkdir -p to manage directory structures and git rev-parse to determine the execution context (SKILL.md, Step 1 and Step 5).

command-creator