The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains numerous prompt injection and malicious instruction patterns within its detection engine (scripts/skill_security_auditor.py) and educational documentation (references/threat-model.md). These are used as regex definitions for auditing other skills and as learning examples. Natural instructions in SKILL.md are safe and align with the tool's purpose.
[EXTERNAL_DOWNLOADS]: The skill uses git clone to fetch external repositories for analysis when a user provides a URL. This functionality is essential for the tool's primary purpose as a security scanner for remote skills.
[COMMAND_EXECUTION]: The script executes git commands using subprocess.run with list-based arguments. This is a safe implementation that avoids shell injection. The commands are used to clone and manage temporary directories for auditing.
[PROMPT_INJECTION]: (Category 8: Indirect Prompt Injection surface) The tool processes untrusted external markdown and code files to identify security risks.
Ingestion points: Files are read via Path.read_text() in scripts/skill_security_auditor.py for regex matching.
Boundary markers: The scanner does not use explicit boundary markers or delimiters when reading external file content.
Capability inventory: The skill can execute git clone via subprocess.run and perform file system cleanup with shutil.rmtree.
Sanitization: Content is processed for pattern matching without sanitization; however, the script does not execute the audited code, minimizing risk.

skill-security-auditor