The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted project data to generate persistent agent instructions.
Ingestion points: The workflow reads data from .bkit/btw-suggestions.json, CLAUDE.md, and project source files (Steps 1 and 2) to populate the new skill's description and logic.
Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands when interpolating external content into the generated SKILL.md file.
Capability inventory: The skill uses Read, Write, Edit, Glob, Grep, and Bash tools. Furthermore, it explicitly grants these same broad permissions to every generated skill by default in the template.
Sanitization: There is no evidence of sanitization, filtering, or validation for the content retrieved from suggestion files or project code before it is written to the new skill definition.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to analyze project structure and source code. While this is functional for a development workflow, the use of shell execution on project files creates a standard but relevant attack surface if project files contain malicious filenames or paths designed to exploit shell expansion.
[DYNAMIC_EXECUTION]: The skill performs dynamic instruction generation by creating new SKILL.md files based on local project context and templates. This behavior allows the agent to expand its own capability set at runtime based on the contents of the local environment.

skill-create