The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to audit other skills by reading their SKILL.md content and passing it to a subagent for evaluation. This creates an attack surface where a malicious or poorly-authored skill could contain instructions intended to influence the auditor's judgment or the audit results.
Ingestion points: Reads SKILL.md files from both global (~/.claude/skills/) and project-local (.claude/skills/) directories.
Boundary markers: The evaluation prompt uses [INVENTORY] and [CHECKLIST] headers, but the subagent reads the full, unsanitized content of the skills being audited.
Capability inventory: The skill can read arbitrary files, execute local scripts, write results to a local JSON file, and perform project inventory. It also instructs the agent to propose file deletions or merges based on subagent verdicts.
Sanitization: No escaping or sanitization is performed on the content of audited skills before they are processed by the AI subagent.
[COMMAND_EXECUTION]: The skill executes local bash scripts (scan.sh, quick-diff.sh, save-results.sh) to perform file system operations. These scripts use standard utilities like find, jq, awk, and hardcoded node -e snippets for sorting. The execution is confined to the local environment and targets paths relative to the skill's installation or project root.

skill-stocktake