The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted content from the open web to generate permanent instructions for the agent.
Ingestion points: SKILL.md Step 3 specifies fetching and extracting content from 3-5 external URLs discovered via web search.
Boundary markers: Absent. The instructions do not include delimiters or warnings for the agent to ignore malicious instructions embedded in the researched documentation.
Capability inventory: The skill uses file system write tools to save generated skills and GitHub CLI to create gists.
Sanitization: Absent. While there is a verification step for factual accuracy, there is no validation or sanitization to prevent malicious instructions from being incorporated into the generated SKILL.md.
[DATA_EXFILTRATION]: The skill includes an option to export generated content to a public GitHub Gist (SKILL.md Step 7). If the research process accidentally captures sensitive information or is poisoned by a malicious source, this data could be publicly exposed.
[PERSISTENCE]: The skill creates persistent agent behavior by saving generated instructions to the user's home directory (~/.claude/skills/) or plugin storage. This allows any instructions (potentially malicious ones from an indirect injection) to persist and influence the agent across all future sessions.
[COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) and file system tools to manage and store skills locally and remotely.

self-learning