The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests untrusted text files and processes their content using an LLM. Adversarial instructions hidden in a project's documentation or todos could be executed by the agent if it lacks strict boundary isolation.
Ingestion points: The skill reads arbitrary .md, .txt, and .rst files from the local filesystem.
Boundary markers: The documentation specifies that code blocks are treated as read-only, but does not describe delimiters used to separate user-controlled prose from the agent's internal instructions when calling the LLM.
Capability inventory: The skill has the ability to execute shell commands (python3 -m scripts) and perform destructive file writes (overwriting original files).
Sanitization: There is no evidence of sanitization or escaping of the processed text before it is sent to the LLM.
[COMMAND_EXECUTION]: The skill initiates local code execution by running a Python module (python3 -m scripts) located in a sibling directory. While this is the intended mechanism for the skill's logic, it represents the execution of local scripts on the host system.
[SAFE]: The skill implements proactive data protection by explicitly refusing to process sensitive file paths. It blocks access to credential-heavy directories and files, such as ~/.ssh/, ~/.aws/, and .env files, which significantly reduces the risk of accidental credential exposure.

unslop-file