The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a framework for ingesting and processing untrusted data from other skill files to perform audits and automated fixes. This creates a vulnerability to indirect prompt injection attacks where instructions hidden in the file being audited could manipulate the agent's logic.
Ingestion points: Target skill markdown files passed to the preflight.py script and read during the Phase 2 audit process defined in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or clear separation between the agent's instructions and the untrusted data being audited.
Capability inventory: The skill utilizes the Edit tool for file modifications, the WebFetch tool for URL verification, and shell command execution for the syntax validator script.
Sanitization: There are no explicit instructions for sanitizing or escaping content from the audited files before they are processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Python script (scripts/preflight.py) using the uv run command. While the script's logic is focused on benign syntax and structural checks, the execution of local scripts on user-supplied content is a significant capability that contributes to the skill's attack surface.

skill-perfection