The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits and evaluates other skill files, which creates a surface for indirect prompt injection if the audited content contains malicious instructions designed to influence the auditor's output.
Ingestion points: The scripts skills_auditor.py, compliance_checker.py, and skill_analyzer.py read skill metadata and body content from SKILL.md files and their referenced modules across the filesystem.
Boundary markers: The documentation does not describe the use of XML tags or specific delimiters to separate audited content from the auditor's own instructions, nor does it mention explicit 'ignore' directives for processed data.
Capability inventory: The skill possesses code execution capabilities via tool_performance_analyzer.py, which runs local executables, and filesystem read access across the project directory.
Sanitization: No sanitization or escaping of the ingested skill content is mentioned before the AI processes it for scoring and quality improvement suggestions.
[DYNAMIC_EXECUTION]: The skill features a utility designed to automatically execute local files discovered during directory scans.
Evidence: The tool_performance_analyzer.py script is documented to time executable files by running them with the --help flag. Evidence in modules/integration-testing.md shows the use of subprocess.run([tool_path, "--help"]) on files found at runtime. While the documentation provides clear warnings to only use the tool on trusted code, this behavior constitutes dynamic execution of local scripts.

skills-eval