The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function includes auditing existing SKILL.md files (Step 1 of Audit Workflow in SKILL.md). These files are untrusted data that the agent reads into its context.
Ingestion points: The agent reads the full SKILL.md of external skills during the audit process.
Boundary markers: Although the skill uses XML tags for its own structure, it does not mandate specific delimiters or warnings to separate the audited content from its own instructions.
Capability inventory: The agent is empowered to write files (Phase 2), generate scripts (Phase 4), and execute shell commands (subprocess.run).
Sanitization: There are no instructions for sanitizing or escaping the content of the audited skills before processing.
[DYNAMIC_EXECUTION]: The references/scripts-guide.md file encourages a 'bias toward scripts' and provides templates for generating Python scripts at runtime. It specifically recommends the use of uv run --script with PEP 723 metadata to dynamically install dependencies during execution.
[COMMAND_EXECUTION]: The skill provides patterns in references/scripts-guide.md for the agent to execute shell commands using Python's subprocess.run. It specifically includes logic for enabling shell=True on Windows to handle command shims, which increases the risk of command injection if parameters are not properly sanitized.
[EXTERNAL_DOWNLOADS]: The recommendation to use uv run in references/scripts-guide.md facilitates the automatic download and installation of Python packages from the public PyPI registry at runtime.

skill-maker