The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and evaluate untrusted data from local file paths provided by users, creating a vulnerability to embedded instructions.
Ingestion points: The workflow involves confirming local paths and inspecting SKILL.md files from user-specified directories in the Inspect the source skill step.
Boundary markers: The instructions lack specific guidance on using delimiters or "ignore embedded instructions" markers when reading these external files.
Capability inventory: The agent is granted the ability to write files to the repository, execute Python scripts via the shell, and perform git operations including pushing to a remote repository.
Sanitization: The skill relies on manual oversight ("Watch for...") rather than programmatic sanitization or strict schema validation, which can be bypassed by sophisticated prompt injection attacks within the processed skill content.
[COMMAND_EXECUTION]: The skill's primary management functions rely on executing local Python scripts using shell commands with user-derived arguments.
The documentation in SKILL.md (Step 4) illustrates the construction of a shell command for python3 scripts/register_skill.py that interpolates multiple variables like <slug>, <title>, <summary>, and <absolute-source-path>.
If these variables are populated directly from user input or extracted from untrusted SKILL.md files without rigorous validation or escaping, it presents a risk of command injection, allowing an attacker to execute arbitrary shell commands with the agent's privileges.

yao-open-skills-sync