Function process_skill_content 

pub async fn process_skill_content(content: &str, ctx: &PromptContext) -> String

Process a skill’s Markdown body: substitute variables, then execute inline commands.

Security

To prevent user-supplied arguments from injecting new commands:

1. All command regions are extracted FIRST from the original content.
2. Variable substitution runs only on non-command text (placeholders protect command regions from both substitution and injection).
3. After substitution, the result is scanned for any NEW command markers. If found, substitution is rejected and the content is returned without command execution.
4. Original commands are executed and their output replaces the placeholders.