The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes the content of SKILL.md files and plugin descriptions from external directories (skills/ and ~/.claude/plugins/). This creates an attack surface where malicious instructions hidden in those files could influence the agent's behavior during the routing or explanation process.\n
Ingestion points: Skill manifest files (SKILL.md) and session-loaded plugin descriptions.\n
Boundary markers: The skill lacks explicit markers or instructions to treat ingested file content as untrusted data, relying instead on high-level operational constraints ('name, don't invoke').\n
Capability inventory: The skill utilizes file system tools including Read, Grep, Glob, and Bash to retrieve and parse content.\n
Sanitization: No mechanisms are defined to sanitize or filter out potentially malicious prompt instructions from the analyzed skill files.

skill-explorer