The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the UserPromptSubmit hook system, which intercepts user prompts to inject suggested skill content into the agent's context. This architectural pattern creates a surface for indirect prompt injection where untrusted user input could potentially trigger unintended context injections.
Ingestion points: User prompts are ingested via stdin by the .claude/hooks/skill-activation-prompt.ts script as described in HOOK_MECHANISMS.md.
Boundary markers: The system uses visual text delimiters (e.g., box-drawing characters and headers like 'SKILL ACTIVATION CHECK') to separate injected context from the user prompt.
Capability inventory: The hook system includes the ability to block tool execution (via PreToolUse exit codes) and provide additional instructions to the agent.
Sanitization: The provided guide focuses on regex matching but does not explicitly detail sanitization or escaping of the user's prompt content before processing.
[DYNAMIC_EXECUTION]: The architecture relies on the execution of local TypeScript scripts (.claude/hooks/*.ts) at runtime using npx tsx. These scripts are triggered by prompt submission or tool usage to perform logic-based matching and enforcement.
[COMMAND_EXECUTION]: The troubleshooting and setup guides (SKILL.md, TROUBLESHOOTING.md) instruct the user to execute various shell commands, including chmod +x for script permissions and manual execution of the hook scripts using piped JSON data for testing purposes.

skill-developer