The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses dynamic context injection in SKILL.md to execute a shell command at load time. Specifically, it runs python3 ~/.claude/skills/aap/scripts/aap_parser.py $ARGUMENTS. The direct interpolation of $ARGUMENTS into the shell string without proper quoting or escaping enables shell argument injection which could lead to arbitrary command execution if a user provides malicious input.
[PROMPT_INJECTION]: The skill processes external Agent Action Plan (AAP) documents, which are untrusted data sources. This creates a surface for indirect prompt injection where content within those documents could manipulate the agent.
Ingestion points: The content of the file at <file-path> is read by the parser and returned to the agent's context (in scripts/aap_parser.py).
Boundary markers: There are no markers or delimiters used to separate the document content from the agent's instructions, nor is the agent warned to ignore embedded instructions.
Capability inventory: The skill has access to powerful tools like Bash, Read, Glob, and Grep via its allowed-tools configuration.
Sanitization: No validation or sanitization is performed on the ingested text to prevent it from containing malicious instructions.
[COMMAND_EXECUTION]: The file scripts/aap_parser.py utilizes dynamic module loading via __import__ to load the tree_sitter_markdown library. While the module name is hardcoded in this script, dynamic loading is a technique that can be used to bypass static analysis or load modified code at runtime.

aap