The Agent Skills Directory

[PERSISTENCE]: The doctor utility in scripts/_lib/doctor.mjs modifies the AI agent's local configuration file (.claude/settings.local.json) to install persistent hooks (UserPromptSubmit, SessionStart, Stop). This ensures that the skill's adapter script executes automatically during every prompt submission and session lifecycle event.
[COMMAND_EXECUTION]: The skill provides a generic execution framework in scripts/_lib/execute.mjs and scripts/_lib/proof.mjs that can spawn arbitrary CLI commands defined in project-level manifests, posing a risk of arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The scripts/_lib/providers.json file contains a catalog of external tools and libraries, providing commands to download and install them from various third-party sources and public repositories.
[INDIRECT_PROMPT_INJECTION]: The skill scans multiple directory paths, including user-defined environment variables, to aggregate skill metadata. This allows for potential indirect prompt injection if a malicious skill configuration is placed in one of the scanned roots.
Ingestion points: scripts/_lib/skills.mjs reads metadata from SKILL.md and skill.json files found in various root directories.
Boundary markers: No LLM-level boundary markers or warnings are used when processing external metadata.
Capability inventory: Arbitrary shell command execution via spawn and file system modification through configuration writes.
Sanitization: Structural validation is performed on metadata, but instruction content and paths are used in routing without deep content sanitization.
[PRIVILEGE_ESCALATION]: By modifying the agent's core configuration to insert its own code into the execution lifecycle, the skill effectively escalates its operational scope across all of the agent's future interactions.

compass