The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is highly vulnerable to indirect prompt injection because it ingests untrusted external data and has the capability to modify the filesystem of another skill.
Ingestion points: scripts/fetch-docs.py downloads content from raw.githubusercontent.com (lines 17-20).
Boundary markers: None. The scripts/process-docs.py script performs only "basic processing" and does not add delimiters or warnings to the content before it is stored.
Capability inventory: scripts/update-skill.py contains capabilities to delete the target skill's directory (shutil.rmtree at line 86) and overwrite its files (shutil.copy2 at line 41).
Sanitization: None. Content is read and written as raw text without validation or escaping.
[External Downloads] (LOW): The skill makes network requests to fetch updates and documentation.
Evidence: scripts/check-updates.py (line 30) and scripts/fetch-docs.py (line 20) use the requests library.
Status: Downgraded to LOW per [TRUST-SCOPE-RULE] because the target repositories (anthropics/anthropic-sdk-python and anthropics/claude-agent-sdk-python) are within the trusted anthropics organization.

anthropic-docs-updater