The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from an external MCP server (prompts.chat). This creates a surface for indirect prompt injection where a malicious skill entry could contain instructions intended to influence the agent's behavior during the installation process or thereafter.
Ingestion points: get_skill and search_skills tool outputs.
Boundary markers: None specified in the instructions to separate external data from system instructions.
Capability inventory: File system write access (.claude/skills/).
Sanitization: The instructions do not specify a requirement for validating or escaping the content of the downloaded SKILL.md or scripts before saving them.
[REMOTE_CODE_EXECUTION]: The skill's installation routine involves downloading scripts (Python, shell, etc.) from an external provider and saving them to the user's local filesystem. While this is the intended functionality, it facilitates the introduction of unverified code into the local environment.
[COMMAND_EXECUTION]: The skill instructs the agent to perform directory creation and file writing operations on the local filesystem (.claude/skills/{slug}/).

skill-lookup