The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a 'Companion check' section in SKILL.md that instructs the agent to execute a shell command (ls ~/.claude/skills/ ~/.agent/skills/ ...) to discover which other skills are installed on the local system.
[EXTERNAL_DOWNLOADS]: The skill encourages the installation of additional remote content by recommending the command npx skills add AbsolutelySkilled/AbsolutelySkilled --skill <name> for several companion skills listed in the metadata.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its environment discovery mechanism.
Ingestion points: The output of the ls command (local directory contents) is ingested into the agent's context.
Boundary markers: There are no markers or instructions to treat the file system output as untrusted data.
Capability inventory: The agent is granted shell execution capabilities to perform the check and can further execute npx commands to install remote packages.
Sanitization: No sanitization or validation is performed on the names of the files/directories returned by the shell before the agent processes them to decide on further installations.

api-design