The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes content from other (potentially untrusted) skills to generate rule suggestions.
Ingestion points: The scripts/scan-skills.sh script reads SKILL.md files from both global (~/.claude/skills) and project-level directories.
Boundary markers: While the subagent prompt in SKILL.md uses headers to separate inputs, it does not include explicit warnings to ignore instructions embedded within the ingested text.
Capability inventory: The skill is designed to modify rule files in ~/.claude/rules/ (appending, revising, or creating new files), providing a clear path for an injection to affect system behavior.
Sanitization: There is no evidence of sanitization or filtering applied to the content of the skills before they are processed by the LLM subagent.
[COMMAND_EXECUTION]: The skill executes local bash scripts to perform inventory and scanning tasks.
Evidence: The skill calls scripts/scan-skills.sh and scripts/scan-rules.sh to read directory structures and file contents.
Context: These scripts use environment variables (e.g., RULES_DISTILL_DIR) to override default paths, which is intended for testing but allows the tool to be pointed at any directory for scanning.

rules-distill