The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingest and processes the full text of all installed skills to extract behavioral principles.
Ingestion points: The scripts/scan-skills.sh script reads the contents of SKILL.md files from both global (~/.gemini/skills) and project-level directories, providing this content to the LLM analyzer.
Boundary markers: The subagent prompt in SKILL.md interpolates untrusted skill content into the {full text of skills in this batch} placeholder without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has the capability to modify or create rule files (.md) within the user's rules directory, which governs future agent behavior.
Sanitization: No technical sanitization or filtering is performed on the ingested skill text before it is processed by the LLM.
Mitigation: The process includes a mandatory "Phase 3: User Review & Execution" step, ensuring that no rules are modified or created without human oversight and manual approval.

rules-distill