The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill-add-finalize.sh script executes chmod +x on files within a directory specified by the agent. Because these files are dynamically generated by the agent during the skill's execution, this provides a pathway for escalating the permissions of generated content to executable status.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest descriptions and requirements to scaffold new skills. It lacks explicit input validation or boundary markers to prevent malicious instructions from being incorporated into the generated SKILL.md files or accompanying scripts.
[DYNAMIC_EXECUTION]: The skill automates a script generation workflow. It writes shell script content to the local filesystem and subsequently uses a secondary script to modify the file permissions, preparing the newly created code for execution.

pflow-skill-add