The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits user-provided skill directories, which involves reading untrusted Markdown, YAML, and script files into the agent's context.
Ingestion points: Phase 1 in SKILL.md reads the target skill's SKILL.md and all files within the references/, workflows/, and scripts/ subdirectories into context.
Boundary markers: The instructions do not utilize delimiters or specific boundary markers when processing external file content, making it susceptible to embedded instructions.
Capability inventory: The skill possesses Bash, Edit, Read, Glob, and Grep capabilities which increase the potential impact of a successful injection.
Sanitization: No sanitization or escaping of the ingested content is performed before processing.
[COMMAND_EXECUTION]: The workflows/catalog-fit.md workflow instructs the agent to probe local system paths to identify existing skills.
Evidence: Probes paths such as ~/.local/share/cortex/*/bundled_skills/ and ~/Library/Application Support/cortex/*/bundled_skills/ using shell-accessible tools.
[EXTERNAL_DOWNLOADS]: Fetches configuration data from official documentation.
Evidence: Retrieves a list of bundled skills from https://docs.snowflake.com/en/user-guide/cortex-code/bundled-skills to perform collision checks.

review-skill-sflabs