The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions include keywords commonly associated with prompt injection (e.g., 'ignore previous instructions', 'system prompt'). These are used as specific detection criteria for the agent to identify malicious patterns in other skills it audits, rather than being an attempt to override the agent's own behavior.
[PROMPT_INJECTION]: As a security auditing tool, the skill has an inherent indirect prompt injection attack surface. It is designed to ingest and process untrusted data from project source code and other installed skills while possessing capabilities such as shell execution and file writing.
Ingestion points: The skill reads project root files, source code, and external skill directories (e.g., ~/.claude/skills/).
Boundary markers: The agent is instructed to be 'methodical, thorough, and paranoid' and is explicitly tasked with searching for and flagging injection patterns in the data it scans.
Capability inventory: The skill allows the use of Bash, Write, and Grep tools, enabling it to execute commands and modify files based on its analysis.
Sanitization: The skill relies on the agent's logic to distinguish between data and instructions; no explicit technical sanitization of the scanned content is provided before interpolation.
[DATA_EXFILTRATION]: The skill includes a telemetry feature that sends status, version, and platform information to a configured external endpoint (Convex). This is an opt-in feature that explicitly prompts the user for consent and provides instructions on how to disable it.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to utilize standard security tools (e.g., npm audit, cargo audit, pip-audit) which perform network requests to official package registries to retrieve vulnerability data. These operations are part of the skill's primary function and target well-known, trusted services.

cso