The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted data from external skill directories during audits. * Ingestion points: The scripts/scan_skill.py tool reads file content and metadata from target directories specified by the user. * Boundary markers: The instructions do not define specific delimiters to isolate the content of scanned files from the agent's core instructions. * Capability inventory: The skill is granted Read, Grep, Glob, and Bash permissions to perform its analysis. * Sanitization: The analysis is performed by a Python script that outputs structured JSON, providing a layer of abstraction between the raw untrusted content and the agent's final reasoning process.
[PROMPT_INJECTION]: Multiple reference files and scripts contain common prompt injection strings such as 'ignore previous instructions' and 'DAN mode'. These are identified as documentation and detection regex patterns rather than active instructions for the agent.
[REMOTE_CODE_EXECUTION]: The skill's reference files document various remote code execution patterns (e.g., reverse shells, curl piped to bash). These are provided as examples for the auditor to detect and do not represent the skill's own behavior.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run its bundled static analysis script (scripts/scan_skill.py). This is justified by the skill's primary function of performing deep structural and content-based audits of other files.
[EXTERNAL_DOWNLOADS]: The skill documentation references the uv tool from Astral (docs.astral.sh) for Python environment management. This is a reference to a well-known service and is considered safe documentation.

skill-scanner