The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several local repository scripts to perform validation and catalog maintenance. These include shell scripts like lint-skills-frontmatter.sh, validate-agents-md.sh, and validate-commands.sh, as well as Node.js utilities like gen-skill-manifest.mjs and check-trigger-fixtures.mjs. These executions are limited to local files and are central to the skill's utility purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a content generator that ingests user-provided ideas to create draft skill files. This creates a surface where malicious instructions could be persisted into the repository's instruction set.\n
Ingestion points: User-provided skill ideas and artifact descriptions (SKILL.md, Step 1).\n
Boundary markers: There are no explicit delimiters or sanitization logic mentioned for handling the user's input before it is used to generate the SKILL.md and EXAMPLE.md drafts.\n
Capability inventory: The skill can write files to the skills/ and commands/ directories, append to AGENTS.md, and execute local scripts.\n
Sanitization: The skill relies on manual user confirmation during the 'Why Gate' (Step 2) and the 'Promote' step (Step 7), but lacks automated sanitization of the input content.

utility-pm-skill-builder