The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-provided keywords directly into a shell command: grep -rni "<keywords>" "$MEMORY_DIR/". This allows for command injection if the user input contains shell metacharacters like semicolons, pipes, or backticks, potentially enabling arbitrary command execution on the host.- [DATA_EXFILTRATION]: The skill accesses the directory $HOME/.claude/projects/, which is a sensitive path containing the agent's interaction history and project-specific memory. Accessing this data exposes private interaction logs to the extraction process.- [INDIRECT_PROMPT_INJECTION]:\n
Ingestion points: The skill reads historical interaction data from the project's memory directory (MEMORY_DIR) as specified in the Step 1 workflow in SKILL.md.\n
Boundary markers: Absent; the content is retrieved via grep and passed to the next stage without delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill executes shell commands (grep, sed), writes multiple files (SKILL.md, README.md), and spawns sub-agents (skill-extractor).\n
Sanitization: Absent; while the skill includes quality gates for the final output, it does not sanitize or escape the data read from the memory files before processing.- [DYNAMIC_EXECUTION]: The skill uses a secondary agent (skill-extractor) to dynamically generate and write executable skill files based on the contents of the potentially untrusted memory logs.

extract