The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process third-party SKILL.md files and metadata, which are untrusted external inputs.
Ingestion points: The skill fetches candidate skill directories (Step 2), including SKILL.md, LICENSE files, and metadata from external registries resolved from user input.
Boundary markers: The instructions explicitly direct the agent to treat license strings and frontmatter fields as data rather than instructions. It also mandates a read-only subagent context for the analysis phase (Step 2-4) to prevent unauthorized execution.
Capability inventory: The installer possesses write capabilities to the local filesystem (~/.claude/skills/) and manages the setup of hooks/hooks.json and MCP servers that execute shell commands.
Sanitization: Implements strict pattern matching for license identifiers against a fixed SPDX list, human-in-the-loop approval gates (Step 6), and structural schema validation of incoming skills via skills-qa.
[EXTERNAL_DOWNLOADS]: The skill facilitates the fetching of code, scripts, and configuration from external registries and publishers resolved from user commands as part of the installation workflow.
[COMMAND_EXECUTION]: The installer manages the setup and verification of hooks/hooks.json and .mcp.json files, which are standard mechanisms for defining shell commands and external programs to be executed within the agent environment.
[DATA_EXFILTRATION]: The skill reads local environment configuration files (allowlist.yaml, CLAUDE.md) and logs installation metadata, including external registry URLs and publisher details, to a structured install-log.yaml file for auditing purposes.

skill-installer