The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to run local Python scripts such as scripts/list-capabilities.py, scripts/generate-skill-index.py, and scripts/generate-agent-index.py to retrieve metadata and counts of skills and agents within the repository.
[DYNAMIC_EXECUTION]: The skill interpolates user-supplied arguments directly into a shell command string: python3 scripts/list-capabilities.py search <query>. This pattern is vulnerable to command injection if the user provides malicious input that is not properly sanitized before being passed to the shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from repository files, which could contain malicious instructions embedded by an attacker.
Ingestion points: The skill reads content from SKILL.md files in the skills/ directory and markdown files in the agents/ directory.
Boundary markers: The instructions do not specify the use of delimiters or instructions for the agent to ignore potentially malicious content within the ingested files.
Capability inventory: The agent has access to file reading tools and the ability to execute local scripts, providing a path for injected instructions to trigger actions.
Sanitization: No explicit instructions are provided to sanitize or escape the content retrieved from repository files before it is processed or presented to the agent context.

workflow-help