The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script (scripts/validate-metadata.py) using arguments (--name and --description) derived from user input. This pattern presents a command injection risk if the agent interpolates user input into the shell command without proper escaping.
Evidence: SKILL.md Step 1, Instruction 3: python3 scripts/validate-metadata.py --name "[name]" --description "[description]".
[DYNAMIC_EXECUTION]: The skill's primary purpose involves generating new skill directories and scripts which are intended for subsequent execution. This process of creating and then running unverified code is a significant vector for potential malicious activity.
Evidence: SKILL.md Step 4 outlines bundling single-purpose scripts into a scripts/ directory.
Evidence: assets/SKILL.template.md includes a procedure for the agent to execute generated scripts: python scripts/[script-name].py.
[INDIRECT_PROMPT_INJECTION]: The skill implements a feedback loop where the agent is prompted to "self-correct" based on the stderr output of the validation script. This allows external data to influence the agent's behavior through the script's output.
Ingestion points: Metadata fields (name, description) in SKILL.md (Step 1).
Boundary markers: Absent from both the script execution command and the instructions for processing error output.
Capability inventory: The skill possesses file system modification capabilities (directory creation in Step 2) and command execution capabilities (Step 1, Step 5).
Sanitization: While scripts/validate-metadata.py includes basic validation logic, it does not sanitize its own stderr output to prevent the inclusion of malicious instructions.

skill-creator