The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses extremely assertive language such as "ABSOLUTELY MUST," "not negotiable," and "not optional" to compel the agent to use external skills. It explicitly commands the agent to suppress its own decision-making process with instructions like "You cannot rationalize your way out of this," which is a technique used to bypass an LLM's internal reasoning and safety checks.
[PROMPT_INJECTION]: The skill mandates a workflow that automatically ingests and follows external skill content, creating a surface for indirect prompt injection.
Ingestion points: External instructions are loaded into the agent context via platform-specific tools such as Skill (Claude Code), skill (Copilot CLI), and activate_skill (Gemini CLI) from files in the local environment.
Boundary markers: The skill does not provide delimiters or warnings to treat invoked content as untrusted; instead, it instructs the agent to "follow skill exactly," which increases the risk of executing malicious instructions contained in a third-party skill file.
Capability inventory: While following invoked skills, the agent has access to a wide range of sensitive tools across platforms, including file modification (Write, Edit, replace), shell command execution (Bash, run_shell_command), and subagent dispatching (Task, spawn_agent).
Sanitization: The framework lacks any mechanism for validating the integrity, source, or safety of external skills before they are activated.

using-superpowers