The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses an 'AUTONOMOUS MODE' instruction, which attempts to override standard agent interaction patterns by telling the agent not to ask questions and to decide/build independently.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests untrusted user input via $ARGUMENTS to generate a complete codebase, including build scripts and test suites. It then instructs the agent to execute these generated scripts during the 'Verification' and 'Self-Healing' phases.
Ingestion points: $ARGUMENTS (SKILL.md).
Boundary markers: None present around the user input interpolation.
Capability inventory: The agent is instructed to run shell commands (npm test, pytest, go build, etc.) on content it just generated from untrusted input.
Sanitization: No evidence of sanitization or validation of the generated code before execution.
[COMMAND_EXECUTION]: Phases 9 and the 'Self-Healing Validation' section explicitly instruct the agent to execute shell commands to build and test the generated project. This includes running build tools (tsc, cargo, go build) and test runners (vitest, pytest, go test) which can execute arbitrary code defined in the generated project files.
[DATA_EXFILTRATION]: The 'Self-Evolution Telemetry' section instructs the agent to search for and write metadata to ~/.claude/projects/skill-telemetry.md. While used for 'evolution', writing execution details to a hidden directory in the user's home folder without explicit user consent is a data exposure risk.

fintech-api