The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts and displays content from SKILL.md files found in both core plugin and project-local directories to generate its inventory report. This ingestion of external file content into the agent context constitutes a potential injection surface.
Ingestion points: Reads frontmatter and description fields from SKILL.md files located in ~/.claude/plugins/cache/bkit-marketplace/bkit/*/skills/ and .claude/skills/project/*/SKILL.md.
Boundary markers: Absent; the skill parses and reproduces text from these files directly into the terminal output.
Capability inventory: The skill uses Bash, Read, Glob, and Grep tools to locate files and extract specific lines of text.
Sanitization: There is no evidence of filtering or sanitizing the content read from the external SKILL.md files before displaying them to the user.

skill-status