The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates the $ARGUMENTS variable directly into shell commands within the instruction set. Specifically, the variable is placed inside double quotes in git log --since="$ARGUMENTS days ago" and git diff "@{$ARGUMENTS days ago}". A user could provide a malicious argument (e.g., 7" ; rm -rf / ; #) that breaks out of the intended command structure to execute arbitrary bash commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by ingesting and processing untrusted data from the project's file system and version history.
Ingestion points: The skill reads the contents of CLAUDE.md files and output from git log and git diff commands.
Boundary markers: There are no boundary markers or instructions to the agent to ignore potentially malicious directions embedded within the audited files or commit messages.
Capability inventory: The skill has access to Read, Grep, Bash(git log:*), Bash(git diff:*), Bash(git status:*), and Bash(find:*).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the audited files or git history before it is processed by the agent.

claude-md-drift-audit