The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bunx skills find or npx skills find to search for skills. This pattern executes a package from a public registry (NPM) without specifying a version, which could lead to the execution of unauthorized code if the package name is hijacked or if a malicious version is published to the registry.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external sources (GitHub search results and marketplace descriptions) and is instructed to feed this content into the /skill-creator tool. This creates a vulnerability surface where a malicious skill description could influence the agent's behavior during the 'handoff' phase.
Ingestion points: Data is collected from the skills.sh website, GitHub code search results, and local skill files.
Boundary markers: The instructions do not define boundary markers or explicit 'ignore' instructions for the extracted content, increasing the risk that the agent may follow instructions embedded within the data it is analyzing.
Capability inventory: The skill has the ability to invoke the /skill-creator tool and write to the local file system (./docs/skill-discovery.md).
Sanitization: There is no evidence of sanitization or filtering of the extracted descriptions before they are used to build the handoff prompt.
[DATA_EXPOSURE]: The skill accesses the ~/.claude/skills/ directory to inventory locally installed skills. While this is expected behavior for a discovery tool, accessing hidden configuration directories in the user's home folder is a sensitive operation.

find-skills