The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data which creates a vulnerability surface for indirect instructions to influence agent behavior. \n
Ingestion points: The skill reads several project-level files including package.json, build.gradle, Package.swift, and performs recursive grep scans over source code files (.swift, .kt, .html, .css, etc.) during the SCAN and AUDIT phases. It also reads git diff output. \n
Boundary markers: No explicit delimiters or instructions are provided to the model to ignore embedded instructions within the project files being analyzed. \n
Capability inventory: The skill possesses extensive capabilities including Bash, Write, Edit, Read, and Artifact tools. \n
Sanitization: There is no evidence of sanitization or filtering of external content before it is interpolated into the agent's context. \n- [DYNAMIC_EXECUTION]: The skill dynamically resolves paths and executes scripts, which is a medium risk behavior. \n
Dynamic loading (computed paths): The skill uses a complex SKILL_BASE resolution logic that scans numerous system and user directories (e.g., /sessions, ~/.claude/plugins/cache, ~/.agents/skills) to locate its sub-modules. It then uses cat to dynamically load instruction files (SKILL.md, GUIDE.md) from these computed paths via the load_skill and load_ref functions. \n
Script execution: The AUDIT phase executes a local Python script using a computed path: python3 "$SKILL_BASE/design-audit/scripts/audit.py" . --group tells. \n- [COMMAND_EXECUTION]: The skill relies on shell commands for environment discovery and auditing. \n
Execution method: The skill uses the Bash tool to run commands like find, grep, ls, and cat across project and system directories to detect the technology stack and identify UI patterns.

cast