The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands that include user-supplied input (e.g., python scripts/search_with_positions.py "search term"). This pattern creates a potential command injection vulnerability if the agent or the underlying platform does not properly escape or sanitize the search terms before passing them to the shell.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on processing external markdown files located in the references/ directory. This creates a surface for indirect prompt injection where instructions embedded in the data could influence the agent's behavior.
Ingestion points: Content is retrieved from references/DND5eSRD_XXX-YYY.md files via search scripts.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for the retrieved content.
Capability inventory: The skill has the ability to execute local Python scripts (scripts/search_with_positions.py, scripts/expand_context.py) and standard shell utilities (ls, grep).
Sanitization: There is no mention of sanitization, escaping, or validation of the content retrieved from the reference files before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill uses local Python scripts at runtime to perform search and context expansion. While these scripts are part of the skill's distribution, their execution with dynamically generated arguments represents a standard dynamic execution pattern.

dnd5e-srd