The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The script render-graphs.js uses child_process.execSync to run the system dot command. It extracts content from SKILL.md using regex and pipes it directly into the command's standard input without any validation or sanitization. This allows for potential exploitation if the input content is maliciously crafted.
[PROMPT_INJECTION] (HIGH): Documentation in references/persuasion-principles.md and references/bulletproofing.md explicitly teaches the use of 'Authority' and 'Commitment' principles (e.g., 'YOU MUST', 'No exceptions', 'Delete means delete') to bypass agent rationalization. These are functional prompt injection patterns designed to override the agent's default reasoning and safety filters.
[EXTERNAL_DOWNLOADS] (MEDIUM): The skill recommends using npx claude-skills-cli, which involves downloading and executing code from an untrusted third-party NPM package that is not included in the trusted source list.
[INDIRECT_PROMPT_INJECTION] (HIGH): The skill possesses a high-severity attack surface through render-graphs.js, which ingests data from SKILL.md (untrusted source) and uses it in a system execution context (execSync). There are no boundary markers or sanitization routines to prevent a malicious markdown file from influencing the execution environment.

writing-skills