The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided documentation, workflows, and requirements to generate new agent instruction sets and scripts. This creates a vulnerability surface where malicious instructions embedded in the input data could be inadvertently incorporated into the resulting skill.
Ingestion points: External data sources including user requirements and documentation files placed within the references/ directory during skill creation.
Boundary markers: The skill does not provide clear delimiters or instructions to the agent to ignore embedded commands within the data it processes.
Capability inventory: The skill possesses the ability to write files to the local filesystem (Path.write_text) and modify file execution permissions (chmod 0o755).
Sanitization: There is no evidence of sanitization or validation of the content used to populate the generated skill templates.
[PRIVILEGE_ESCALATION]: The script scripts/init_skill.py performs a permission modification (chmod 0o755) on the scripts/example.py file it generates. Although this is standard for creating executable scaffolding, it represents an escalation of privileges for dynamically created content.
[DYNAMIC_EXECUTION]: The skill uses string templates to dynamically generate new Python scripts (scripts/example.py) during the project initialization phase. This script generation is based on parameters like the skill name and title provided at runtime.
[COMMAND_EXECUTION]: The package includes functional Python scripts (init_skill.py and package_skill.py) that perform filesystem operations, including directory creation, file writing, and archiving (zipping) contents, which are intended to be executed in the user's environment.

skill-creator