The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the command npm run skills:migrate with various arguments to manage the migration process. This is a standard project-level script for the tool's functionality.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) as it is designed to process and migrate external skill files. Evidence Chain: 1. Ingestion points: Scans ~/.claude/skills, ~/.openclaw/skills, ~/.hermes/skills, and user-provided custom paths for SKILL.md files. 2. Boundary markers: The migration process does not implement specific delimiters or 'ignore' instructions for the content of the files being moved. 3. Capability inventory: The skill utilizes npm scripts to perform file system read and write operations across the identified directories. 4. Sanitization: There is no evidence of content sanitization or validation for the skills being migrated. However, the workflow mitigates risk by requiring user interaction and confirmation at each step.

pilotdeck-skills-migration