The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to potential indirect prompt injection because it ingests and processes untrusted data from project files such as instruction files and package manifests.
Ingestion points: Reads content from project root files (e.g., CLAUDE.md, AGENTS.md, package.json) and checks directories in the user's home path (detect.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external file content as untrusted data.
Capability inventory: The skill is strictly limited to information retrieval and diagnostic output; instructions explicitly forbid file creation, command execution, or git operations (SKILL.md).
Sanitization: There is no evidence of filtering or sanitization of the content extracted from processed files.
[DATA_EXFILTRATION]: The skill checks for the existence of files and directories outside the immediate project root to detect agent memory systems, specifically targeting paths like ~/.claude/projects/*/memory/MEMORY.md and ~/.agentmemory/ (SKILL.md). This is used for diagnostic purposes to verify cross-session memory configuration.
[EXTERNAL_DOWNLOADS]: The skill references external resources on GitHub, including the open-gsd/get-shit-done-redux and obra/superpowers repositories, as recommendations for extending agent capabilities (recommended-skills.md). It also mentions standard packages from public registries for configuration purposes.

harness-audit