The Agent Skills Directory

[SAFE]: The skill performs local file system reads and script execution to facilitate rule distillation. These operations are restricted to relevant directories such as ~/.claude/skills and ~/.claude/rules.\n- [COMMAND_EXECUTION]: The skill executes local bash scripts (scan-skills.sh, scan-rules.sh) to perform inventory tasks. The scripts use standard Unix utilities like find, grep, and jq and include basic path validation to ensure operations remain within expected directories.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes the content of other skills, which is a potential source of untrusted data. A malicious skill could attempt to influence the distillation logic through embedded instructions. This risk is mitigated by the skill's design, which requires manual user review of all proposals and follows strict extraction criteria.\n
Ingestion points: The full text of installed SKILL.md files and existing rule files is passed to an LLM subagent for matching and analysis (Phase 2 in SKILL.md).\n
Boundary markers: The analysis prompt uses template placeholders for skill and rule text but does not define explicit delimiters or 'ignore' instructions for the subagent.\n
Capability inventory: The skill has the capability to execute local scripts, read files, and modify rule files (pending user approval).\n
Sanitization: There is no evidence of specific sanitization or filtering of skill content before it is interpolated into the analyst subagent's prompt.

rules-distill