The Agent Skills Directory

Indirect Prompt Injection Considerations: The skill's primary function is to ingest and analyze external skill files (e.g., from Claude Code or Cursor). This represents a potential surface for indirect prompt injection, where instructions embedded in the source file could attempt to influence the agent's behavior during the conversion process.
Ingestion points: Uses read_file to ingest source skill content in Step 3.
Boundary markers: The instructions do not explicitly mandate the use of XML delimiters or safety headers when processing the external content, though it requires a summary and user confirmation.
Capability inventory: The skill possesses significant capabilities including bash execution, file writing (write_file), and agent delegation (delegate).
Sanitization: No explicit sanitization or filtering of the source content is mentioned before it is processed or used to generate new code.
Dynamic Execution Pattern: In Step 7, the skill follows a workflow where it saves generated code to a configuration path and immediately invokes load_skill to test it. This dynamic loading of agent-generated content derived from external sources is a security pattern that warrants user review of the generated code before the test step is executed.
File System and Command Execution: The skill uses the bash tool and writes files to configuration-sensitive paths such as ~/.amplifier/skills/ and .amplifier/skills/. While these are necessary for the skill's intended purpose of registering new capabilities, users should be aware of the modifications being made to their local environment.

adapt-skill