The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the directories and files of plugins being audited, which presents a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads all files within a target plugin path (e.g., plugins/security/plugin-name/), as well as metadata files like .claude-plugin/plugin.json and marketplace.extended.json (SKILL.md).
Boundary markers: The instructions provide a structured audit process and report template, but do not specify clear delimiters or "ignore embedded instructions" warnings for the content read from external plugin files.
Capability inventory: The skill utilizes Read, Grep, and Bash(cmd:*) tools, which provide the agent with substantial file system and command execution capabilities (SKILL.md).
Sanitization: While the skill uses jq for JSON validation, it lacks explicit mechanisms to sanitize or filter natural language instructions that might be embedded in the audited code or documentation before they are processed by the agent.

plugin-auditor