The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to read the name and description from all SKILL.md files found on the local filesystem (including ~/.config) and from an external API (https://skills.sh/api/search). Content from these external sources could contain malicious instructions designed to influence the agent's behavior when it processes and displays the metadata.
Evidence Chain:
Ingestion points: Reads SKILL.md files from the local filesystem and JSON data from https://skills.sh/api/search.
Boundary markers: None specified to delimit external content from instructions.
Capability inventory: File writing (card-loop/board.md), git commits, and network access.
Sanitization: No sanitization of the name or description fields is mentioned before they are processed or displayed to the user.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to https://skills.sh/api/search. This domain is an unknown external service, and the data retrieved is used to suggest software installations to the user.
[COMMAND_EXECUTION]: The skill generates a command for the user to manually execute: npx skills add <source>@<skillId> -g -y. Although the instructions explicitly tell the agent not to run the command itself, providing pre-formatted commands that install software from an untrusted external source (skills.sh) poses a risk to the user's environment if the suggested skills are malicious.

jt-find-skills