The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit external 'SKILL.md' and related files. This creates an attack surface where a malicious skill being reviewed could contain instructions designed to influence the reviewing agent.
Ingestion points: The REVIEW mode (referenced in references/review-skill.md) reads and audits existing skill directories provided by the user.
Boundary markers: The instructions emphasize a 'neutral stance' and 'fresh-context' subagents to isolate the analysis, but explicit string-level boundary markers (like XML tags or delimiters) are not mandated for the raw file ingestion.
Capability inventory: The skill uses run_eval and bash via the skill-eval MCP tools, which could potentially execute code if a malicious input successfully diverts the agent's logic.
Sanitization: The skill relies on external MCP tools (validate_skill) for linting and structural checks rather than manual prose interpretation, which serves as a primary sanitization layer.
[COMMAND_EXECUTION]: The skill instructions frequently reference the execution of shell commands and bundled scripts.
Evidence: references/build.md states that bundled scripts should be executed or read as reference, and references/eval.md mentions that no arbitrary shell commands should be used in checks, favoring typed kind-based assertions in the server code.
[DYNAMIC_CONTEXT_INJECTION]: The skill documents the use of dynamic injection using the backtick syntax.
Evidence: references/build.md describes the !command syntax that runs at render time for preprocessing. While it notes this can be disabled by policy, the presence of the feature is documented as a core capability for skill authoring.

skill-craft