The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes npx skills list and npx skills list -g via the bash tool in Step 2 to inventory available skills. These commands are used for state discovery and do not incorporate unvalidated user input into the shell execution line.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from repository files to suggest and configure skills. An attacker could place malicious instructions in files like README.md to influence the wizard's recommendations.
Ingestion points: In Step 1, the skill reads content from README.md, CLAUDE.md, pyproject.toml, package.json, and other project markers.
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are used when the agent processes the contents of these files for stack inference.
Capability inventory: The skill uses the Skill() tool to load discovered candidates and the Write tool to create the .dh/skill_discovery.yaml configuration file.
Sanitization: The skill applies a regex pattern [a-z0-9-]+:[a-z0-9-]+ when parsing skill identifiers, which helps ensure that suggested skill names conform to expected naming conventions.- [SAFE]: The skill includes an interactive confirmation step (Step 5) in its primary user-facing mode, allowing the user to review the generated YAML configuration and answer refining questions before any files are written to disk. This human-in-the-loop checkpoint significantly mitigates the risk of automated misconfiguration.

setup-skill-discovery