The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes the entire conversation history as untrusted input to generate a decision brief. This surface is vulnerable to indirect prompt injection, where malicious instructions embedded in the conversation could influence the agent's behavior.
Ingestion points: The skill explicitly uses the conversation history as its primary data source (SKILL.md).
Boundary markers: No boundary markers or instructions to ignore embedded commands are present to protect against injection from the conversation content.
Capability inventory: The skill possesses file system write capabilities, including directory creation (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering applied to the conversation content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations, including directory creation (mkdir -p) and file writing, based on user-provided arguments.
Evidence: The skill logic states: "If $ARGUMENTS gives a path, save there" and specifies a default path of docs/decisions/<slug>.md (SKILL.md).
Risk: If the underlying agent platform does not strictly validate the path provided in $ARGUMENTS, an attacker could potentially use directory traversal (e.g., ../../...) to write files to unauthorized or sensitive locations on the host system.

tradeoffs