The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute standard filesystem commands (ls, find, cat, grep) to discover and analyze mobile project structures. These commands are restricted to local environment detection and are consistent with the skill's stated purpose.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it is instructed to read and process untrusted local files such as Podfile, build.gradle, and package.json. Malicious content within these files could attempt to manipulate the agent's behavior or reporting logic.
Ingestion points: SKILL.md instructs the agent to read multiple project configuration files using cat and grep in Step 0.
Boundary markers: There are no explicit instructions or delimiters used to separate the content of audited files from the agent's internal logic, making it susceptible to embedded instructions.
Capability inventory: The skill has access to Bash and WebFetch tools, which could be exploited if an injection is successful.
Sanitization: No sanitization or validation of the external file content is performed before the agent processes it.
[PROMPT_INJECTION]: There is a version inconsistency in the skill's metadata. SKILL.md lists version 0.6.4, while .claude-plugin/plugin.json lists version 1.9.1. Inconsistent metadata can be used to misrepresent the provenance or capabilities of a skill.

touch-audit