The Agent Skills Directory

[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by gathering unvalidated user metadata and storing it in a CONTEXT.md file that other skills are instructed to read. This could allow a user to inject instructions that influence the behavior of those downstream tools.
Ingestion points: Metadata fields such as key_constraints and success_criteria collected in SKILL.md.
Boundary markers: No boundary markers or delimiters are used in the CONTEXT.md template to separate user-provided data from instructional context.
Capability inventory: Downstream skills like /discover-infrastructure and /assess-app-portfolio are designed to process this file, which may result in the execution of injected instructions.
Sanitization: No sanitization or escaping is performed on the user-provided metadata before writing it to the filesystem.
[COMMAND_EXECUTION]: Step 2 of the workflow generates and executes a shell script block that interpolates a <customer_slug> variable. Although the skill suggests an auto-generation step for this variable, the design pattern of interpolating user-influenced data directly into shell commands creates a potential command injection risk if the agent's internal sanitization logic is bypassed.

setup