The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process the contents of other AI agent skills provided via the target argument, which are potentially untrusted data sources.
Ingestion points: The contents of the directory and files resolved from the user-provided <SKILL_NAME_OR_PATH> are read and passed to the plugin-dev:skill-reviewer agent and a fixer subagent.
Boundary markers: The skill definition does not specify the use of clear delimiters or explicit instructions to ignore embedded commands when the subagents process the target skill's content.
Capability inventory: The skill utilizes powerful tools including Bash, Glob, Read, and Workflow. If a subagent were compromised via an indirect prompt injection, these tools could potentially be used for unauthorized file access or execution.
Sanitization: No explicit sanitization, validation, or filtering of the content within the target skill is mentioned in the logic.

skill-improver