The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The sync.sh script aggregates auto_invoke metadata from all skills within the repository and injects this content into AGENTS.md files. This architectural pattern creates a vulnerability surface where a malicious or compromised skill could inject instructions that are then promoted to repository-level agent guidelines.
Ingestion points: Metadata fields (auto_invoke, scope) are extracted from skills/*/SKILL.md files in sync.sh using awk and sed.
Capability inventory: The skill uses the Bash, Read, and Write tools to perform repository-wide modifications to AGENTS.md and related documentation files.
Boundary markers: Content is injected under a standard ### Auto-invoke Skills header, but the instructions do not include explicit delimiters or warnings for the agent to ignore potentially malicious embedded instructions in the metadata.
Sanitization: The synchronization logic performs basic string cleaning such as quote removal and whitespace trimming, but it does not validate or sanitize the semantic content of the auto_invoke strings before writing them to the destination files.

skill-sync