The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and audit third-party skill directories and MCP server descriptions, which constitutes a significant attack surface for indirect prompt injection. The skill implements an evidence chain to mitigate this: (1) Ingestion points: Untrusted third-party files are parsed during 'intake' and 'audit' recipes. (2) Boundary markers: Mandatory sandbox verification is required before host-context execution. (3) Capability inventory: Uses system commands for scanning (find, grep), process management (kill, launchctl), and file operations (quarantine). (4) Sanitization: Includes procedures to detect hidden instructions like Unicode Tags and bidi overrides.
[REMOTE_CODE_EXECUTION]: The skill contains strings that match remote code execution patterns, such as example commands in the documentation (e.g., 'python -c "$(curl...)"'). These are strictly educational examples used to teach the agent what malicious patterns to identify during an audit and do not represent executable code within the skill.
[COMMAND_EXECUTION]: To perform its auditing and eradication duties, the skill provides numerous shell commands for the agent to execute for system inventory and persistence identification. These are intended for use in a controlled security responder capacity.
[EXTERNAL_DOWNLOADS]: The skill references external security research sources and known malicious infrastructure within its IoC database for threat intelligence and pattern matching. These references are used for source citation and identifying compromised packages.

chain