The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md explicitly mandate the execution of any shell commands and code blocks found within the documents being drafted. The instruction "Run each one in this repository at the time it is written, and match any stated output to the real output" creates a vector for arbitrary code execution if the input source (the brief.md or user corrections) contains malicious commands.
[INDIRECT_PROMPT_INJECTION]: The skill uses a multi-agent verification workflow that is susceptible to indirect prompt injection. The draft content, which includes untrusted user input and brief data, is passed to a secondary agent to answer "reader questions."
Ingestion points: The skill ingests untrusted data from brief.md, existing content files in content/posts/, and direct user corrections.
Boundary markers: There are no instructions to use delimiters or "ignore instructions" warnings when passing draft text to the secondary verification agent.
Capability inventory: The skill has the capability to execute shell commands via subprocess calls and perform file system write operations.
Sanitization: The skill lacks any explicit sanitization or filtering of external content before it is interpolated into prompts or executed as code.
[DYNAMIC_EXECUTION]: The skill executes local scripts and preview servers (e.g., scripts/preview.sh) defined in publication configuration files. This dynamic execution path relies on the integrity of local files and configuration, which could be exploited if an attacker manages to modify these files through other vectors.

draft-piece