The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The 'Find Missing Skills' section provides instructions to use npx skills add <owner/repo@skill> -g -y to search for and install new functionality. This pattern allows for the download and execution of arbitrary code from remote GitHub repositories at runtime.
[DYNAMIC_EXECUTION]: The skill enables the dynamic loading of new skills during a session, allowing for the execution of unverified logic that was not part of the initial skill set. The instruction to 'add owner/repo@skill' indicates that code paths are computed or derived from external identifiers.
[PROMPT_INJECTION]: The skill uses extremely coercive directives in the <EXTREMELY-IMPORTANT> and 'Anti-Rationalization Guards' sections, such as 'YOU DO NOT HAVE A CHOICE', 'This is not negotiable', and 'No exceptions. No rationalization.' These are patterns designed to override the agent's internal reasoning and safety guardrails by forcing tool invocation regardless of the agent's evaluation.
[INDIRECT_PROMPT_INJECTION]: The 'Phase 1: Skill Identification' workflow processes user tasks to identify and load matching skills with a low relevance threshold (1%), creating a surface for indirect prompt injection.
Ingestion points: User-provided task descriptions and conversation content used to identify matching skills in the catalog.
Boundary markers: None; the skill mandates invocation if there is even a '1% chance' of relevance, increasing susceptibility to adversarial input.
Capability inventory: The skill has the capability to invoke the Skill tool (loading markdown/YAML files) and execute shell commands via npx for skill installation.
Sanitization: There is no mention of sanitizing or validating user input before it is used to drive the selection and execution of skills.
[EXTERNAL_DOWNLOADS]: The use of npx commands to fetch skills from a decentralized ecosystem represents an external download risk from non-whitelisted, community-maintained sources.

using-toolkit