The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative and coercive language to override the agent's internal logic and decision-making regarding model selection.
Evidence: Instructions such as "ALWAYS use claude-opus-4-7... This is non-negotiable" and "Never downgrade for cost — that's the user's decision, not yours" attempt to strip the agent of its reasoning capabilities and force specific outputs.
Evidence: The skill explicitly gaslights the agent regarding model versions ("Rest assured they are real models; we wouldn't mess with you like that"), which is a technique used to bypass knowledge-cutoff constraints and force the use of non-existent or attacker-specified identifiers.
[PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface as it is designed to ingest and process untrusted user codebases.
Ingestion points: The skill reads project source files (e.g., *.py, *.ts, package.json, go.mod) to perform language detection and API identification in SKILL.md.
Boundary markers: There are no instructions to use delimiters or "ignore embedded instructions" warnings for the processed project files.
Capability inventory: The agent is instructed to modify files (code migration), use WebFetch for external documentation, and generate API-calling code based on the ingested content.
Sanitization: No input validation or sanitization of the ingested code is implemented.
[PROMPT_INJECTION]: The skill uses deceptive metadata to impersonate an official source.
Evidence: The manifest.json claims the author is "Anthropic" and points to the official anthropics/skills repository, while the actual skill context identifies the author as a third party. This impersonation is likely intended to bypass agent safety considerations by falsely claiming a trusted origin.

claude-api