The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from local agent, skill, and command files, which are potentially untrusted data sources.\n
Ingestion points: Files are read from local directories such as .claude/agents/, .claude/skills/, and .claude/commands/ as part of the audit discovery phase.\n
Boundary markers: Results are outputted into Markdown and JSON reports. The skill does not define unique delimiters or provide instructions to prevent a reading agent from interpreting the extracted audited content as commands.\n
Capability inventory: The skill utilizes Read, Grep, Glob, Bash, and Write tools to perform file analysis and report generation.\n
Sanitization: The skill uses yaml.safe_load for parsing configuration data. However, it does not perform explicit sanitization or escaping of arbitrary text content extracted from audited files before including it in the output reports. Note that the disable-model-invocation: true configuration in the skill frontmatter effectively mitigates the risk of the agent executing instructions from the audited files during the audit process.

audit-agents-skills