The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell scripts (scan.sh, quick-diff.sh, save-results.sh) to perform inventory management and state tracking.
These scripts follow security best practices, such as using set -euo pipefail for error handling, mktemp for safe temporary file creation, and jq --arg to prevent command injection when handling JSON data.
Path handling includes defense-in-depth checks to verify that project-level skill directories follow expected naming conventions (e.g., matching */.codex/skills*).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection during the quality evaluation phase (Phase 2).
Ingestion points: The content of all audited skills (including frontmatter and body) is read from the filesystem and interpolated into the [INVENTORY] block of the subagent's prompt in SKILL.md.
Boundary markers: There are no protective delimiters or explicit instructions to the subagent to ignore embedded commands within the audited data, increasing the risk that the agent will follow instructions contained within the analyzed files.
Capability inventory: The subagent used for evaluation is a "general-purpose" agent which, according to the checklist, may use WebSearch to verify references, providing an avenue for the subagent to be influenced into making untrusted network requests.
Sanitization: No sanitization or escaping is performed on the content of the audited skills before they are passed to the subagent. This allows a malicious skill to include instructions that override the auditing agent's behavior (e.g., instructions to always return a "Keep" verdict regardless of quality).

skill-stocktake