The Agent Skills Directory

[COMMAND_EXECUTION]: The script skill-add-finalize.sh executes chmod +x on all files within a scripts/ subdirectory of a target path provided by the agent. This behavior programmatically elevates file permissions for content generated by the AI.
[COMMAND_EXECUTION]: The --name argument in skill-add-finalize.sh is used to construct a file system path (target="$SKILLS_DIR/$name") without validation. An attacker or a confused agent could provide a path containing directory traversal sequences (e.g., ../../) to modify permissions of files outside the intended directory scope.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. In skill-add-context.sh, the script reads and parses the description field from every SKILL.md file in sibling directories and includes this data in the context for Step 1. Malicious instructions placed in the metadata of an existing skill could influence the agent's behavior during the scaffolding process.
Ingestion points: Reads SKILL.md files from sibling directories in scripts/skill-add-context.sh.
Boundary markers: None. The raw content of the description field is interpolated into the JSON output.
Capability inventory: The agent has the capability to write files to the filesystem (Step 3) and execute chmod +x (Step 4) via skill-add-finalize.sh.
Sanitization: The script uses a simple regex to extract the description and performs basic JSON escaping, but does not sanitize the content against natural language instructions.

pflow-skill-add