The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands to resolve local script paths, read project files, and manage temporary files for context aggregation.
[DATA_EXPOSURE]: The skill collects context from the local project, specifically the first 80 lines of CLAUDE.md and the first 40 lines of project manifests (e.g., package.json, requirements.txt). This metadata is aggregated into a temporary file and passed to the grep-api.js script for processing. While this transmits project data to a service, it is limited to non-sensitive project structure and conventions necessary for the skill's research function.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to generate a new SKILL.md instruction file based on data retrieved from an external research API. This creates a surface where potentially malicious or misleading content from the research source could influence the logic of the generated skill.
Ingestion points: User arguments ($ARGUMENTS), local project manifest files, and the external output from the grep-api.js research call.
Boundary markers: The skill does not explicitly use delimiters to isolate research output from the prompt used to generate the final instructions.
Capability inventory: The skill has the capability to read/write local files and execute vendor-provided scripts.
Sanitization: There is no explicit sanitization or validation of the research output before it is incorporated into the generated SKILL.md file.
[DYNAMIC_EXECUTION]: The skill dynamically generates and saves a production-ready SKILL.md file. These instructions are intended to be executed or interpreted by the AI agent in future sessions, which is the core intended purpose of the tool.

grep-skill-creator