The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from untrusted external sources, such as documentation websites, GitHub repositories, PDFs, and video transcripts. This creates an inherent risk where malicious instructions embedded in those sources could influence the agent's behavior.
Ingestion points: Data enters the agent context via tools like scrape_docs, scrape_github, scrape_pdf, scrape_video, and scrape_generic (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or directives to ensure the agent ignores instructions found within the scraped content.
Capability inventory: The skill has access to sensitive tools for local file access (scrape_codebase), network data transmission (upload_skill, export_to_weaviate, etc.), and system-level changes (install_skill).
Sanitization: The documentation provides no evidence of content sanitization or validation during the scraping and processing workflow.
[DATA_EXFILTRATION]: The skill provides tools for reading local codebase directories (scrape_codebase) and subsequent tools for uploading results to external platform APIs (upload_skill) or exporting to remote vector databases (export_to_faiss, export_to_qdrant, etc.). This creates a pathway for local data to be moved to external endpoints.
[COMMAND_EXECUTION]: The install_skill tool describes an end-to-end installation workflow, which involves executing commands on the host system to package and deploy new software skills.

skill-builder