The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and evaluates the content of other SKILL.md files to identify improvement opportunities. Malicious instructions embedded within an audited skill could attempt to influence the agent's behavior during the review process.
Ingestion points: SKILL.md files are loaded via the Read tool in Step 1 and Step 4 from global, project, and plugin paths.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from following directives contained within the files being audited.
Capability inventory: The skill utilizes Bash, Read, Glob, and Grep, providing a significant capability surface if an injection is successful.
Sanitization: There is no evidence of sanitization or filtering of the content being read before it is processed by the LLM.
[DATA_EXFILTRATION]: The skill is designed to access files in ~/.claude/skills/*/SKILL.md (Global level). This allows the agent to read data from the user's home directory outside of the active project environment. While this is consistent with the skill's stated purpose of auditing all installed skills, it constitutes access to sensitive configuration areas.

skill-auditor