The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local binary named 'ask' using either Bash or PowerShell. In SKILL.md, it uses Bash(CCB_CALLER=claude ask $PROVIDER "$MESSAGE"). In SKILL.md.powershell, it uses Start-Process to run the same binary, passing user-provided message content via standard input redirection from a temporary file.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: The $MESSAGE variable in both SKILL.md and SKILL.md.powershell acts as a conduit for untrusted user-provided data.
Boundary markers: There are no boundary markers or 'ignore' instructions wrapping the $MESSAGE variable to prevent the AI provider from interpreting embedded instructions.
Capability inventory: The skill has the capability to execute subprocesses (ask binary) and write to the file system (via New-TemporaryFile in PowerShell).
Sanitization: No sanitization or validation is performed on the $MESSAGE content before it is passed to the subprocess or written to disk.

ask