The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to discover, read, and apply instructions from SKILL.md files found within the repository being analyzed (e.g., in ./skills/ or ./.claude/skills/). This architecture allows a malicious codebase to provide poisoned instructions that the agent may then execute as part of its analysis workflow.
Ingestion points: The scripts/list_skills.py script (line 63) and the analysis workflow in SKILL.md (Step 3) ingest instructions from the local repository.
Boundary markers: Absent. The instructions do not define clear delimiters or warnings to isolate instructions found in the codebase from the agent's primary directives.
Capability inventory: The skill utilizes shell execution to run the list_skills.py script and has the capability to write a CODEBASE_OVERVIEW.md file to the filesystem.
Sanitization: The list_skills.py script performs basic string parsing of YAML frontmatter but does not validate or sanitize the instruction content for malicious prompt injection patterns.

learn-codebase