The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use sed for template substitution using unsanitized shell variables ($SKILL_NAME, $DESCRIPTION). This implementation allows for potential command injection if a user provides input containing shell metacharacters like backticks, semicolons, or dollar signs, which could be executed by the shell during the file generation process.
[REMOTE_CODE_EXECUTION]: The workflow generates Python scripts and shell commands at runtime and facilitates their installation into global, system-wide directories (such as ~/.copilot/skills/) via symlinks. This creates a mechanism for the persistence and execution of dynamically generated code on the host machine.
[DATA_EXFILTRATION]: The skill accesses the host system's git configuration using git config user.name and git config user.email to extract personal identity information for attribution in the generated metadata. This constitutes reading local configuration data without an explicit security warning or confirmation prompt.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it incorporates untrusted, user-provided strings directly into the core instruction files (SKILL.md) of the generated skills.
Ingestion points: Phase 1 (Brainstorming and Planning) where the user provides the skill purpose, triggers, and description.
Boundary markers: Absent; user-provided content is directly interpolated into templates without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill possesses capabilities for file system modification (mkdir, ln), file writing, script generation (init_skill.py), and shell execution (sed, chmod).
Sanitization: Absent; there is no validation, filtering, or escaping of user input before it is used in shell commands or written to the file system.

skill-creator