The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation workflow in SKILL.md instructs the agent to fetch content from user-provided URLs and explicitly directs the agent to follow instructions in a setup file (e.g., INSTALL.md) from those sources. This creates a pattern for executing arbitrary remote code.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and install content from external sources, which is a significant attack surface for indirect prompt injection. A malicious skill package could contain hidden instructions targeting the agent.
Ingestion points: The skill provides a mechanism to fetch content from URLs and archives in SKILL.md.
Boundary markers: There are no security boundary markers or instructions to disregard potential commands within the fetched content.
Capability inventory: The skill context includes tools for bash command execution, python script execution, and file system modifications.
Sanitization: The quick_validate.py script performs structural and format validation but does not analyze the logic or security of scripts within the skill.
[DYNAMIC_EXECUTION]: Through scripts/init_skill.py, the skill generates new Python files and sets file permissions to executable. This facilitates the runtime creation and preparation of executable code.
[COMMAND_EXECUTION]: The management of skill files involves shell commands for extraction, moving directories, and packaging, which could be targeted by path traversal or command injection if inputs are maliciously crafted.

skill-creator