The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/check.py script uses subprocess.run to execute internal validation and packaging scripts like validate_skill.py and package.py. This functionality is intended for developer verification and does not involve untrusted input flowing into shell commands.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It reads SKILL.md files from multiple local directories and incorporates their content into the agent's context. A malicious skill file placed in these locations could attempt to influence the agent's behavior.\n
Ingestion points: The scripts/skill_index.py script reads from various local roots including repository, project, and global agent skill stores (~/.claude/skills/, ~/.agents/skills/, etc.).\n
Boundary markers: The context command separates skill content using Markdown headers but lacks explicit instructions to the agent to ignore potentially malicious embedded directives within the skill bodies.\n
Capability inventory: The indexing tool performs file reads and metadata ranking; it does not have network access or file-write capabilities.\n
Sanitization: Skill content is truncated to a length limit (120,000 characters) but is otherwise passed as raw text to the agent.

skill-router