The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative instructions to mandate a behavior override, directing the agent to "Use this before starting substantive work on ANY request." This establishes a persistent interception layer that attempts to govern all user interactions before the agent proceeds with its primary task.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to discover, read, and prioritize instructions from all files found in specific local directories, creating an ingestion surface for untrusted content.
Ingestion points: Local filesystem paths such as ~/.claude/skills/ and .claude/skills/ are targeted for scanning all SKILL.md files regardless of their publisher or source.
Boundary markers: None. The agent is not instructed to treat the discovered content as external or untrusted data, nor are delimiters provided to isolate the ingested frontmatter.
Capability inventory: The skill encourages the agent to traverse the local filesystem and read the contents of various directories to identify available skills.
Sanitization: None. The agent is directed to judge the relevance of the raw name and description fields from discovered files and is explicitly told to "use them instead of improvising a process from scratch," effectively allowing third-party file content to dictate its behavior.

skill-router