The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project history ($HOME/.claude/projects/.../memory) and user-provided descriptions to generate new skill files. This creates an attack surface where malicious instructions or patterns present in the project history could influence the logic or content of the newly created skill.
Ingestion points: User-provided pattern descriptions and historical project memory files (referenced in Step 1).
Boundary markers: The skill defines a strict Markdown template in Step 5 to constrain the generated output.
Capability inventory: The skill performs shell searches via grep and writes files to the local file system through an automated agent.
Sanitization: Step 6 includes mandatory 'Quality gates' that instruct the agent to strip project-specific paths, URLs, and credentials before finalizing the skill.
[COMMAND_EXECUTION]: The workflow involves executing shell commands (e.g., grep -rni "<keywords>" "$MEMORY_DIR/") where the search terms are derived from user input. This pattern is vulnerable to shell injection if the agent does not properly escape or sanitize the input before passing it to the terminal.
[DATA_EXFILTRATION]: The skill identifies and reads from sensitive internal directories (Claude's project memory). Although this is the primary purpose of the skill, it involves accessing complete project histories. The inclusion of a publishing command (clawhub publish) creates a path where sensitive information, if not properly caught by the quality gates, could be uploaded to an external repository.

extract