The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted content (other skills' SKILL.md files) which could contain adversarial instructions.
Ingestion points: The skill reads SKILL.md, command definitions, and hook configurations from arbitrary user-provided paths.
Boundary markers: The instructions explicitly identify inputs as "attacker-controlled" and mandate human-in-the-loop approval gates for all security-sensitive findings.
Capability inventory: The skill is limited to reading and analyzing files; it has no declared tools for network access, file writing, or command execution.
Sanitization: While the skill identifies malicious patterns, it relies on an external "restricted mode" environment rather than internal input escaping.
[PROMPT_INJECTION]: The skill instructions include a comprehensive list of prompt injection markers (e.g., "Ignore previous instructions", "forget what user said") and role-play patterns (e.g., "You are now [unrestricted]", "switch to developer mode"). These are correctly implemented as diagnostic signatures used to scan other skills and are not instructions for the agent to follow.
[DATA_EXPOSURE]: The skill references sensitive file paths, including SSH keys (~/.ssh/), AWS credentials (~/.aws/), and GitHub configurations (~/.config/gh/). These references are part of a security check to detect if other skills are attempting unauthorized data access and do not involve this skill accessing those paths itself.

skills-qa