The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill determines the location of its core script (workflows/improve.js) at runtime by searching system paths and the current working directory (.). The resolved path is then executed using the Workflow tool. This search order allows a local directory to provide a malicious script that overrides the intended plugin logic if the plugin is not found in the user's home directory first.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a wrapper for an autonomous loop and ingests untrusted data from multiple sources. It takes user decisions and passes them "verbatim" to the workflow, and it targets files for modification based on user input.
Ingestion points: User-provided arguments and decision strings defined in the Starting the loop and Continuing after an escalation sections of SKILL.md.
Boundary markers: No delimiters or instructions are used to separate user rulings from the agent's internal logic.
Capability inventory: The skill utilizes Workflow, Bash, Glob, and Read tools, providing the necessary primitives for a successful injection to perform file edits or execute shell commands.
Sanitization: The skill explicitly instructs the agent to pass user rulings without modification or filtering.
[COMMAND_EXECUTION]: The skill employs Bash tools to run discovery commands like ls and find. The specific use of find to locate executable code within the current working directory is the primary driver of the dynamic execution risk.

skill-improver