The Agent Skills Directory

[COMMAND_EXECUTION]: The glossary-finalize.sh script accepts a --path argument that is used with mkdir -p and mv to write the glossary content to a file. Because this path can be influenced by the agent's interpretation of project files (like READMEs or user instructions), it creates a risk of arbitrary file write or overwriting sensitive files if an attacker provides a malicious path through indirect prompt injection.
[PERSISTENCE]: The glossary-finalize.sh script automatically appends rules to AGENTS.md and CLAUDE.md. These files guide agent behavior in future sessions, meaning the skill can be used to persistently alter how other agents interact with the repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data (READMEs, existing glossaries, and documentation) to identify terminology.
Ingestion points: SKILL.md instructions guide the agent to read README.md, GLOSSARY.md, and other documentation files during the terminology identification phase.
Boundary markers: No specific boundary markers or 'ignore' instructions are used when reading these files, which increases the risk of the agent following instructions embedded in the project files.
Capability inventory: The skill can write files, create directories, and modify project-level configuration files (AGENTS.md, CLAUDE.md).
Sanitization: The glossary-finalize.sh script validates the glossary format and sorts rows, but it does not sanitize the content against prompt injection or malicious instructions.

pflow-glossary