The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (scripts/scan-skills.sh and scripts/scan-rules.sh) to index the local filesystem and extract metadata from skill and rule files.
The scripts use standard utilities like find, grep, and jq to process local files in ~/.claude/skills and ~/.claude/rules.
[PROMPT_INJECTION]: The skill's primary mechanism for 'distilling' rules from existing skills creates a surface for indirect prompt injection (Category 8).
Ingestion points: The scan-skills.sh script reads the full text of all installed skills from both global and project-level directories.
Boundary markers: The subagent prompt used for analysis does not define explicit boundary markers or 'ignore embedded instructions' warnings for the untrusted content of the skills being processed.
Capability inventory: The skill possesses the capability to modify and create global agent rule files, which define the security and behavioral boundaries of the AI agent.
Sanitization: No programmatic sanitization or safety-specific validation is performed on the extracted principles before they are drafted as rules for user approval.
Risk: A malicious skill could contain hidden instructions or biased 'best practices' designed to be promoted to global rules, potentially weakening security constraints or enabling persistence for malicious actions across the agent's environment.

rules-distill