The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains numerous prompt injection patterns within references/prompt-injection-patterns.md. These are explicitly included as reference material for the scanner to identify threats in other skills and are not instructions intended to be executed by the agent running this skill.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute its bundled static analysis script (scripts/scan_skill.py) using the uv Python runner. This is a legitimate and necessary function for the skill's primary purpose as a security scanner.
[REMOTE_CODE_EXECUTION]: The references/dangerous-code-patterns.md file contains examples of remote code execution (e.g., reverse shells, netcat usage). These are documented for educational and detection purposes within the scanner's logic and are not functional code within the skill itself.
[DATA_EXFILTRATION]: Both the scanner script and reference files contain patterns for detecting data exfiltration (e.g., HTTP POSTing environment variables). The skill itself does not perform any network operations or data exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface by ingesting content from external skills for analysis.
Ingestion points: Reads content from target skill directories (SKILL.md, scripts, references) using the scanner script and Read/Grep tools.
Boundary markers: The skill instructions (Phase 4 and Phase 6) provide explicit guidance for the agent to distinguish between malicious code and benign documentation/security research.
Capability inventory: The skill is limited to Read, Grep, Glob, and Bash tools; it lacks Write or Edit permissions, preventing it from modifying the host system based on ingested data.
Sanitization: The scanner produces structured JSON output, and the agent is instructed to perform a multi-phase evaluation of the results to filter false positives.

skill-scanner