The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation in generating-from-docs.md recommends installing the agent-skills-generator utility from a personal Homebrew tap (rodydavis/tap). This source is not a verified vendor or official organization, posing a supply chain risk.
[COMMAND_EXECUTION]: The platform-guide.md reference file documents and demonstrates the use of the !backtick syntax (e.g., !`git status`), which enables shell command execution at the moment a skill is loaded. This feature can be used for silent command execution without user interaction if a skill's content is modified maliciously.
[COMMAND_EXECUTION]: The generating-from-docs.md file contains bash scripts for creating temporary directories and executing external commands (mktemp, cd, rm -rf, agent-skills-generator). These provide an execution surface that an agent might trigger automatically.
[PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from documentation websites (generating-from-docs.md) and session history (extracting-from-sessions.md) to create new instructions. The process lacks mandatory boundary markers or explicit sanitization steps, creating a surface for indirect prompt injection where malicious content in source docs could influence the generated skill's behavior.

skill-authoring