The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and analyze untrusted content from other skills, which is a classic surface for indirect prompt injection. A malicious skill being analyzed could contain instructions designed to deceive the analyzer agent.
Ingestion points: The skill reads and processes the contents of SKILL.md, script files, and reference documents from a user-provided directory.
Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple quotes) or 'ignore' prefixes when the agent reads external content.
Capability inventory: The skill uses uv run to execute a bundled Python scanner and ls to list file contents. The agent is also instructed to read and interpret script logic.
Sanitization: The skill relies on a static analysis script and manual agent review, but no automated sanitization of the input text is mentioned.

skill-scanner