The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from third-party skill files and displays raw excerpts in its generated audit reports, creating a vector where malicious instructions inside a scanned skill could influence the agent during report rendering.
Ingestion Points: scripts/skill_cleaner.py dynamically traverses and reads the contents of SKILL.md and script files across multiple local directories via Path.read_text().
Boundary Markers: The report format uses markdown backticks to enclose the raw text snippets, but lacks definitive instructions forcing the model to ignore any embedded directives or prompt payloads.
Capability Inventory: The capability set is limited to local file system operations, allowing the removal of symbolic links and moving directories into a quarantine path using os.unlink and shutil.move.
Sanitization: Snippets are simplified by removing extra whitespace and capping length at 240 characters, but no escaping or evaluation of malicious prompt content is performed on the text before insertion into the context.

xy-skill-audit