The Agent Skills Directory

[COMMAND_EXECUTION]: The skill-run bash script serves as a generic runner that executes file paths provided as a command-line argument using the exec command.
[PRIVILEGE_ESCALATION]: The skill-run script is vulnerable to path traversal attacks. It prepends a base directory path (SKILLS_ROOT) to the user-supplied argument but performs no validation to ensure the resulting path remains within the intended directory. This allows for the execution of arbitrary binaries on the system (e.g., passing ../../../../bin/bash to execute a shell).
[PROMPT_INJECTION]: The SKILL.md file contains instructions that explicitly tell the agent to override human partner instructions. The section 'Instructions ≠ Permission to Skip Workflows' directs the agent to ignore user requests to bypass mandatory workflows or brainstorming steps, which is a form of behavioral override.
[INDIRECT_PROMPT_INJECTION]: The skill implements a mandatory workflow where the agent must search for and read external SKILL.md files from a catalog and 'Follow it exactly.' This creates a risk where malicious content placed in the skills catalog could gain control over agent behavior.
Ingestion points: External files read via the Read tool after being located by find-skills.
Boundary markers: None; the skill explicitly commands the agent to read the 'ENTIRE file' and follow the 'rigid rules' found within.
Capability inventory: The skill provides filesystem searching (find-skills) and arbitrary command execution (skill-run).
Sanitization: None; there is no validation or filtering of the content retrieved from external skill files before the agent follows their instructions.

using-skills