The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and audit user-provided skill directories and SKILL.md files. This creates a surface where malicious instructions within the audited content could attempt to override the agent's behavior during the packaging process.
Ingestion points: Files are read in scripts/scan_skill_release.py and scripts/portfolio.py (via the scan function).
Boundary markers: The instructions define a strict workflow but lack explicit boundary delimiters or 'ignore' instructions when processing the content of audited skills.
Capability inventory: The toolset possesses extensive capabilities including filesystem writes (packaging) and command execution via Git, Node.js, and Python across multiple scripts (scripts/release_portfolio.py, scripts/verify_isolated_install.py).
Sanitization: The skill implements significant defensive measures, including a secret scanner (scan_skill_release.py), a deterministic README and SVG auditor (audit_release_readme.py), and a capability detection module (portfolio.py).
[COMMAND_EXECUTION]: Several automation scripts utilize the subprocess module to interact with the local environment.
Evidence: scripts/check_release_env.py, scripts/git_sync_guard.py, and scripts/release_portfolio.py all use subprocess.run to execute Git operations and verify software versions. While these calls use list-based arguments, they represent the execution of system-level commands.
[EXTERNAL_DOWNLOADS]: The skill workflow involves downloading external payloads and packages.
Evidence: The workflow utilizes npx skills add to fetch and install skills from remote sources, including the zjp1997720/zhijian-skills repository on GitHub. These operations target well-known package registries and the vendor's own infrastructure.

skill-open-sourcer