The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing untrusted external code and metadata from third-party sources such as ClawHub and GitHub. This creates a vulnerability surface where a malicious skill being vetted could contain instructions designed to influence or bypass the vetting agent's logic during the audit process.
Ingestion points: The protocol requires the agent to read all files in a target skill, including SKILL.md, scripts, and metadata via curl and clawhub commands (documented in SKILL.md).
Boundary markers: The instructions do not define specific delimiters or explicit "ignore embedded instructions" warnings to isolate the untrusted content from the agent's internal reasoning.
Capability inventory: The skill utilizes curl for network requests, jq for parsing, and filesystem access to create temporary directories for file analysis (documented in SKILL.md).
Sanitization: No explicit sanitization, filtering, or validation of the fetched content is described before the agent processes it for manual and automated review.
[COMMAND_EXECUTION]: The skill instructions provide template commands for the agent to execute shell utilities including curl, jq, clawhub, find, and cat to fetch, search, and inspect external resources.
[EXTERNAL_DOWNLOADS]: The skill provides instructions and examples for fetching data from GitHub's API (api.github.com) and raw content domains (raw.githubusercontent.com). These references target well-known services and are used for the legitimate purpose of performing security audits on external code.

skill-vetter