The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several commands to perform its search and security functions.
The shell script scripts/scan_skill.sh executes git clone, curl, and uvx to download and scan external skill repositories.
The SKILL.md instructions guide the agent to use npx skills find to search the ecosystem.
These executions are legitimate and necessary for the skill's stated purpose of discovery and security analysis.
[EXTERNAL_DOWNLOADS]: The scripts/scan_skill.sh script downloads content from remote URLs for analysis.
It uses curl to fetch single SKILL.md files and git clone to fetch full repositories.
The script implements security best practices by using temporary directories and a cleanup trap (trap cleanup EXIT) to ensure downloaded content is removed after the scan.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted data from the external skills ecosystem, which is a potential injection surface.
Ingestion points: External skill metadata, READMEs, and script content are read by the agent or the scanner script.
Boundary markers: The instructions explicitly tell the agent to treat these inputs as "arbitrary code" and provide a comprehensive checklist of malicious patterns to look for (e.g., hidden HTML comments, reference links).
Capability inventory: The agent can execute search and installation commands (npx skills) and a scanning script.
Sanitization: The skill encourages human-in-the-loop verification, requiring explicit user confirmation before any installation occurs.
[PROMPT_INJECTION]: Static detectors flagged instructions related to ignoring system prompts and unrestricted modes (e.g., 'ignore previous instructions', 'unrestricted'). However, analysis shows these are part of a security educational checklist provided to the agent to help it detect these behaviors in other skills. They are not attempts to manipulate the agent's own behavior.

find-skills