The Agent Skills Directory

[COMMAND_EXECUTION]: The shell command in SKILL.md uses the $ARGUMENTS variable without quotation marks (e.g., uv run "..." $ARGUMENTS). This construction allows for shell command injection if the arguments passed to the skill contain shell metacharacters like ;, &, or |, potentially leading to arbitrary command execution in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill recursively reads and processes the content of markdown files within a user-provided directory to check for OKF conformance. The validation output, which includes labels like ✗ ERROR and ! warn along with details derived from file content, is interpreted by the agent. A malicious bundle could contain prompt injection strings designed to influence or hijack the agent's behavior during the review of these results.
Ingestion points: The scripts/okf_validate.py script reads the body and frontmatter of all .md files within the target directory.
Boundary markers: Output is delimited by status labels (✗ ERROR, ! warn), but the skill lacks instructions to the agent to treat the content from the bundle as untrusted data.
Capability inventory: The skill uses the Bash tool and has permissions to read and write (via the migration command) files in the local filesystem.
Sanitization: The script correctly utilizes yaml.safe_load() for frontmatter parsing, mitigating YAML-based execution, but it does not sanitize the text content for natural language injections.
[EXTERNAL_DOWNLOADS]: The skill instructions provide a fallback to install the pyyaml package from a well-known package registry using pip. This is a standard and safe dependency management practice.

validate