The Agent Skills Directory

[DATA_EXPOSURE_&_EXFILTRATION]: The skill's workflow includes a 'Gather' step that recursively reads the .local/ directory. This directory is commonly used to store sensitive user data, environment variables, or configuration files. The instruction to treat every subfolder and file as source material creates a significant data exposure risk.
[COMMAND_EXECUTION]: The workflow explicitly requires the agent to run make check as a validation step. Because the skill also involves creating or modifying shell scripts in the scripts/ directory, this command may execute newly generated code without prior user review.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data to generate executable logic.
Ingestion points: Recursive read of the .local/ directory and results from external web searches (SKILL.md, Step 2).
Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded commands within the gathered research material.
Capability inventory: The skill can write files (SKILL.md, evals.json, and shell scripts) and execute commands (make check).
Sanitization: Absent; no filtering or validation is performed on the gathered content before it is used to draft new skill logic and scripts.
[DYNAMIC_EXECUTION]: The skill is designed to generate new shell scripts (scripts/) and markdown instructions (SKILL.md) based on external research. This 'code-generating-code' pattern is inherently risky when the source material includes untrusted web content.
[UNVERIFIABLE_DEPENDENCIES_&_REMOTE_CODE_EXECUTION]: By combining web-based research with script generation and automated execution (make check), the skill facilitates a path for remote instructions found on the web to achieve local execution within the user's environment.

add-skill