The Agent Skills Directory

[OBFUSCATION]: A base64-encoded string is present in the references/threat-model.md file. It is explicitly labeled as an educational example ("Pattern 2: The Obfuscated Payload") to demonstrate how attackers might hide malicious code. The payload decodes to a command attempting to download and execute a shell script.
[PROMPT_INJECTION]: The skill documentation and reference files include common prompt injection strings like "Ignore previous instructions" and "You are now...". These are used as descriptive labels for the tool's detection logic and as examples of threats it identifies, rather than active attempts to override agent behavior.
[COMMAND_EXECUTION]: The core auditor script uses subprocess.run to execute the git clone command. This is used for its legitimate functionality of downloading remote skill repositories to perform local security audits.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process files from untrusted sources during audits, creating an attack surface for indirect prompt injection.
Ingestion points: The scripts/skill_security_auditor.py script reads file content from the target skill directory using Path.read_text.
Boundary markers: None; the script is a local analysis tool that does not pass ingested content directly into LLM prompts.
Capability inventory: The script performs file reads, directory deletions (cleanup), and shell execution for git operations.
Sanitization: The script processes input using regular expressions for pattern matching and does not execute the code it audits.

skill-security-auditor