The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external instruction files (AGENTS.md, CLAUDE.md, etc.) which serve as the primary ingestion point for untrusted data. The scripts/check_instructions.py script extracts shell commands from these files, including those in fenced code blocks (sh, bash, console) and backticked spans.
Ingestion points: The skill reads files matching ^(AGENTS|CLAUDE|CLAUDE\.local)\.md$ and files in .claude/rules/.
Capability inventory: The agent is instructed to use fd to find files and python3 to run the validation script. Crucially, the workflow instructs the agent to "Run every other command you list... before writing it down" to verify their validity.
Boundary markers: The skill provides natural language constraints: "Do not run destructive, publishing, deploy, migration, network, or credentialed commands; run at most their --help or a dry run."
Sanitization: The check_instructions.py script performs no sanitization of the extracted commands; it simply identifies them for the agent's review. The security relies entirely on the agent's adherence to the safety instructions in SKILL.md when processing the extracted commands.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands for discovery (fd) and validation (python3 scripts/check_instructions.py). It also explicitly encourages the execution of commands found within the audited documentation to ensure they are not stale or "invented."

write-agents-md