The Agent Skills Directory

[COMMAND_EXECUTION]: Executes local bash scripts (scan-skills.sh, scan-rules.sh) to enumerate files and extract metadata from the environment.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection. The skill ingests and analyzes the content of all other installed skills. An attacker-controlled skill could include hidden instructions to manipulate the LLM's distillation logic, potentially causing it to propose malicious rules or delete existing safety principles.
Ingestion points: Phase 2 in SKILL.md explicitly reads the full text of skills and existing rules into the LLM context.
Boundary markers: The prompt provided to the subagent uses simple labels ("Input") but lacks robust delimiters or explicit instructions to ignore embedded commands within the analyzed skills.
Capability inventory: The skill is designed to propose additions and revisions to files in the ~/.claude/rules directory.
Sanitization: No sanitization or filtering is performed on the content of the skills being analyzed before they are passed to the LLM.

rules-distill