The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and analyzing external instruction files which may contain adversarial content designed to influence the agent's diagnostic logic or proposed fixes.
Ingestion points: The skill reads repository-local instructions (e.g., AGENTS.md, CLAUDE.md) and the target skill's own instructions (.claude/skills/[name]/SKILL.md).
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to the agent to treat the ingested file content as untrusted data rather than active instructions.
Capability inventory: The skill utilizes Write and Edit tools to modify files within the .claude/skills/ directory based on its analysis of the ingested data.
Sanitization: The skill mitigates risk by requiring explicit user authorization (via the --apply flag or a direct request) before any modifications are written to the disk, and it restricts its write surface to a specific named skill's folder.

skill-improve