The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it processes untrusted data from the current repository.
Ingestion points: The skill uses Glob and Read to extract metadata from plugin.json, SKILL.md, and .mcp.json files found within the user's current working directory (Step 4).
Boundary markers: The instructions do not specify the use of XML delimiters or 'ignore embedded instructions' warnings when presenting the extracted metadata in the final discovery report.
Capability inventory: The skill utilizes Glob, Read, ToolSearch, and Bash (for platform detection).
Sanitization: There is no evidence of sanitization or validation of the content read from repository files before it is interpolated into the markdown catalog output.
[DATA_EXFILTRATION]: The skill performs sensitive file path access to discover configurations.
Evidence: It scans directories such as $HOME/.claude, $HOME/.github, $HOME/.gemini, $HOME/.opencode, and $HOME/.codex to identify installed skills and MCP servers. While this is the primary purpose of the skill, it constitutes access to system-level configuration areas.
[COMMAND_EXECUTION]: The skill employs shell commands for environment detection.
Evidence: Step 0 (Platform Detection) uses a shell script snippet to check for the existence of platform-specific directories using if [ -d ... ] and if [ -f ... ]. This execution is limited to detection and does not involve user-supplied arguments.

agent-skill-discovery