The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md include a directive to the agent to stop reading the file and immediately begin execution of Step 0 ('STOP -- DO NOT READ THIS FILE... Begin executing Step 0 immediately'), which is an attempt to override the agent's standard instruction-following behavior.
[INDIRECT_PROMPT_INJECTION]: The skill takes user input from the <arguments> block and interpolates it into a shell command (gsd_run graphify query <term>) without explicit sanitization, creating a command injection vulnerability surface. 1. Ingestion point: <arguments> block in SKILL.md. 2. Boundary markers: Present (<arguments> XML-style tags). 3. Capability inventory: Extensive use of the Bash tool. 4. Sanitization: Absent; no validation or escaping is applied to the user-supplied term before execution.
[COMMAND_EXECUTION]: The skill uses a complex shell script to search for a vendor-specific binary (gsd-tools.cjs) across a wide range of directories related to different AI agents and IDEs (e.g., ~/.claude, ~/.cursor, ~/.gemini, ~/.cline). While these paths are related to the vendor's expected toolchain, the automated scanning of various tool configuration directories is a noteworthy behavior.

gsd-graphify