qumge.com

The description tells the agent to 'Write the returned markdown to .claude/skills/<name>/SKILL.md ... and it is installed — no other step is needed.' This directs the agent to autonomously write arbitrary third-party content into its own skill directory and treat it as fully trusted/installed, without pausing for user confirmation or review. Since SKILL.md files are themselves instructions the agent will later read and follow, this creates a supply-chain / prompt-injection pathway: a malicious or compromised catalog entry could smuggle in instructions that override agent behavior once 'installed'. The phrase 'no other step is needed' actively discourages any human-in-the-loop check.

Same pattern as get_skill but for multiple skills at once: 'Write each returned skill to .claude/skills/<name>/SKILL.md ... and the whole set is installed — no other step is needed.' This compounds the risk by batch-writing several externally-sourced files directly into the agent's trusted skill directory with no verification or user confirmation step, increasing the attack surface for injected instructions hidden in any one of the bundled skills.