The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides multiple Bash and JavaScript examples that execute system commands for building, formatting, and linting code (e.g., npm, cargo, go, npx). These are found in SKILL.md and resources/hook-examples.md.
[PROMPT_INJECTION]: The skill demonstrates 'Context Injection' and 'Skill Activation' patterns (specifically Example 4 in resources/hook-examples.md) that interpolate user input into the agent's prompt context, creating a surface for indirect prompt injection.
Ingestion points: resources/hook-examples.md contains a script skill-activator.js that reads the user prompt from standard input.
Boundary markers: The injected context uses visual headers (e.g., '🎯 SKILL ACTIVATION CHECK') but lacks strict delimiters or warnings to ignore embedded instructions.
Capability inventory: The hook patterns demonstrate the ability to execute shell commands, write to the filesystem, and send system notifications.
Sanitization: The examples show limited sanitization of user-provided text before it is used for pattern matching or prompt interpolation.
[COMMAND_EXECUTION]: The 'User Notification' pattern in resources/hook-patterns.md executes platform-specific commands such as osascript on macOS and notify-send on Linux.
[COMMAND_EXECUTION]: The 'Graceful Degradation' pattern in resources/hook-patterns.md utilizes the eval command in Bash to execute arbitrary strings passed as command arguments.

building-hooks