The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes untrusted content from remote registries (the SKILL.md and configuration files of skills being updated). A malicious update could contain payload instructions designed to trick the agent into misreporting the scan results or to deceive the human reviewer during the diff verification step.
Ingestion points: Remote registry sources for SKILL.md, hooks/hooks.json, and .mcp.json files.
Boundary markers: The skill does not specify the use of strict data delimiters to isolate the untrusted diff content from the agent's operational logic.
Capability inventory: The skill has the ability to perform network fetches and write files to the local ~/.claude/skills/ directory.
Sanitization: While it mentions URL validation, there is no comprehensive sanitization or filtering of the incoming skill content before it is processed by the agent or displayed to the user.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and replacement of executable files and configurations from external sources. It mitigates the risk of unauthorized updates by pinning immutable commit SHAs and enforcing a mandatory human-in-the-loop approval process for every update.
[COMMAND_EXECUTION]: The skill manages hooks/hooks.json files, which it explicitly identifies as being capable of executing arbitrary shell commands. It flags any changes to these files as a high-risk event requiring human verification.

auto-updater