The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts in the skill (scripts/audit_claude_skill_surface.py, scripts/audit_codex_skill_surface.py, and scripts/audit_skill_delivery.py) utilize subprocess.run and subprocess.Popen to invoke system binaries such as 'claude' and 'codex'. This functionality is intended to collect diagnostic information about the agent's environment.
[DYNAMIC_EXECUTION]: The scripts/audit_codex_skill_surface.py script performs dynamic loading and execution of Python code using exec(compile(...)) and importlib. It targets a local management script, by default ~/.config/claude-switch-models-setup/sync-local-skill-sources.py, to parse activation policies. This mechanism is used for interoperability with local configuration tools.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests and processes data from external tool outputs (e.g., claude plugin marketplace list --json and codex debug prompt-input). While the scripts parse this data as JSON, the content of these external sources could theoretically contain malicious instructions if the underlying system state is compromised.
Ingestion points: scripts/audit_claude_skill_surface.py (line 72), scripts/audit_codex_skill_surface.py (lines 124, 219).
Boundary markers: None explicitly present for the ingested JSON streams.
Capability inventory: The skill has significant capabilities including file system reading and shell command execution via subprocesses across all audit scripts.
Sanitization: The skill uses standard json.loads for parsing, which prevents basic structural injection but does not sanitize the semantic content of the metadata fields for potential downstream influence.

skill-governance