The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill implements a workflow where it fetches remote repository data and instructs the agent to 'Refactor' local files (SKILL.md and wrapper.py) based on that untrusted content.
Ingestion points: scripts/scan_and_check.py extracts github_url from other skills; the agent subsequently fetches remote README files.
Boundary markers: None. The instructions in SKILL.md do not provide delimiters or warnings to ignore instructions found within the fetched remote content.
Capability inventory: The agent is granted the capability to overwrite local skill files and execute deletion commands via scripts/delete_skill.py.
Sanitization: None. The agent is encouraged to adopt 'new features' and 'usage changes' directly from the remote source into local code.
Command Execution & File System Safety (MEDIUM): The scripts/delete_skill.py script performs recursive directory deletion without sanitizing the input skill_name.
Evidence: skill_dir = os.path.join(skills_root, skill_name) followed by shutil.rmtree(skill_dir). An attacker providing a path like ../../ as a skill name could trigger deletion of sensitive directories outside the intended skills folder.
Metadata Poisoning (LOW): The skill relies on metadata (github_url, github_hash) stored in other SKILL.md files. If these are modified by a malicious process, the manager will target attacker-controlled infrastructure for its 'Update' workflow.
Privacy (INFO): Scripts like scripts/list_skills.py and scripts/delete_skill.py contain hardcoded local Windows paths (e.g., C:\Users\20515\...), which leaks information about the developer's environment.

skill-manager