The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests potentially untrusted data from the local environment to inform its authoring process.
Ingestion points: The skill instructions in SKILL.md (Step 2) direct the agent to recursively read all files in the .local/ directory as source material.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to disregard embedded instructions or adversarial content within the ingested files.
Capability inventory: The skill is capable of writing files (e.g., SKILL.md, evals.json, README, CHANGELOG.md) and executing shell commands via the make check command (Step 5) and project scripts (Step 4).
Sanitization: There are no requirements or steps to sanitize, escape, or filter content retrieved from the .local/ directory before it is processed or written into new skill files.
[COMMAND_EXECUTION]: Local command execution is an inherent part of the skill's validation workflow.
Evidence: SKILL.md (Step 5) explicitly instructs the execution of make check. Additionally, Step 4 mentions creating and running deterministic logic via scripts/, which involves the execution of local scripts.

add-skill