The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the conversation history and session memory to generate new instructions.
Ingestion points: Conversation history, session summaries, and memory buffers.
Boundary markers: The skill does not define specific delimiters to isolate user-provided data during the generation phase.
Capability inventory: File system write access via the agent's file-writing tools.
Sanitization: The skill mandates a 'Review before saving' step where the generated content is displayed to the user and requires explicit confirmation before any file is written.
[COMMAND_EXECUTION]: The skill instructs the agent to create and write files to the disk. While this is the intended purpose, it involves dynamic generation of executable markdown content based on session history.
[DATA_EXFILTRATION]: The skill suggests saving generated content to local configuration directories such as ~/.pi/agent/skills/. While this facilitates persistence of legitimate skills, it represents a write operation to user-sensitive configuration paths.

skillify