The Agent Skills Directory

Indirect Prompt Injection Surface: The skill's primary function is to ingest and analyze untrusted external data, such as SKILL.md files and command directories provided by users. This creates a surface where the analyzer could potentially be influenced by instructions embedded within the content it is evaluating. To address this, the skill includes a mandatory heuristic scan (Step 1.5) that explicitly searches for manipulation patterns and warns the agent to treat the new content as untrusted input.
Instruction Pattern Matching: The skill contains numerous strings associated with prompt injection, such as 'ignore previous instructions' and 'disregard the above'. These are used as reference patterns for the heuristic scanner to detect malicious intent in other skills. Their presence is descriptive and essential for the skill's scanning capabilities rather than an attempt to override the agent's own behavior.
Scoped File Access: The skill is configured to read specific files such as CLAUDE.md and allowlist.yaml within the ~/.claude/plugins/config/claude-for-legal/ directory. This access is used to provide context for the evaluation, such as checking for conflicts with already-installed skills or verifying the allowlist status of a publisher. This behavior is documented and consistent with the skill's purpose as a management and QA tool for the 'claude-for-legal' plugin environment.
Security Capability Inventory: The skill identifies and flags high-risk capabilities in other skills, such as shell execution (bash), external network calls (curl/WebFetch), and access to sensitive directories (e.g., .ssh, .aws). While the skill's instructions mention these tools, it does not execute them itself; it only instructs the agent to surface their presence in the target skill as a security consideration for the human user.

skills-qa