The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (list_agent_skills.py) to perform a filesystem inventory of available skills.
[DATA_EXFILTRATION]: The script performs a broad scan of the local filesystem, including home directory configuration paths for various AI tools (Cursor, Claude Code, etc.) and all parent directories of the current workspace. While no network transmission is initiated, this exposes the user's local skill environment and directory structure to the agent's context.
[PROMPT_INJECTION]: The skill processes and presents metadata from externally found SKILL.md files to the agent, creating a surface for indirect prompt injection.
Ingestion points: The list_agent_skills.py script reads and parses frontmatter from any SKILL.md file located in the scanned directories (e.g., ~/.cursor/skills, ~/.claude/skills, or project subdirectories).
Boundary markers: The gathered metadata is presented to the agent in Markdown or JSON format without explicit instructions or delimiters to treat the external descriptions as untrusted data.
Capability inventory: The agent uses this inventory to select skills and subsequently read their full bodies, potentially leading to the execution of instructions embedded in the discovered skills.
Sanitization: The script performs basic quote cleaning but does not sanitize or validate the name or description fields, which could contain malicious prompts designed to influence the agent.

find-local-skill