The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingest and analyzes instructions and code from other installed skills located in host directories like ~/.claude/skills and ~/.codex/skills. This processing of external untrusted data through scripts/skill_cleaner.py presents a potential surface for indirect prompt injection if a scanned skill contains instructions specifically designed to manipulate the auditing agent's output. However, this behavior is essential to the skill's purpose as an auditor, and the risk is mitigated by the tool's read-only nature during scanning and the requirement for explicit user confirmation before any filesystem modifications (such as quarantine) are performed.

xy-skill-audit