The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local maintenance scripts (python3 scripts/init_skill.py) using arguments such as skill names, descriptions, and tags that are parsed directly from external, untrusted directories found on the local system. This creates a surface for command injection if these strings contain shell metacharacters.
[DATA_EXFILTRATION]: The workflow extracts content from files within private local project directories to move them to a different repository. While genericization instructions are provided to strip personal or project-specific data, any failure in the agent's processing could result in the unintended exposure of sensitive metadata, internal usernames, or specific project structures.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by reading and processing untrusted markdown files (SKILL.md) from various projects on the system. Ingestion points: Filesystem scan of project subdirectories for skill files (Step 2). Boundary markers: The instructions lack specific delimiters or isolation protocols to prevent the content of the external files from influencing the agent's behavior during the genericization or validation phases. Capability inventory: The agent is authorized to execute local scripts, modify the skill registry (skills.json), and perform git commit actions. Sanitization: The skill relies on natural language instructions for the LLM to filter content (Step 5) rather than employing programmatic sanitization or a restricted execution environment.

sync-skills