The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from various project documentation files (e.g., AGENTS.md, CLAUDE.md, CURSOR.md) which are potential sources of untrusted data.
Ingestion points: The skill uses Glob to scan for and read the full contents of multiple documentation files identified in SKILL.md (Step 1) and references/file-patterns.md.
Boundary markers: The synthesis step (Step 3) does not define clear delimiters or instructions to ignore potential commands embedded within the documentation sources.
Capability inventory: The skill has access to the Write tool for creating directories (like .doc-archive/) and modifying files, and the Bash tool for command execution.
Sanitization: No sanitization or validation of the ingested file content is performed before it is synthesized into the agent's context.
[COMMAND_EXECUTION]: The skill is granted access to the Bash tool in its frontmatter. While the primary instructions involve using Glob and Read for documentation synthesis, the inclusion of shell access provides a capability for executing system commands, which could be exploited if an indirect prompt injection attack succeeds.

doc-scanner