The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a load_skill function that executes shell commands to dynamically include instruction sets (SKILL.md files) from paths computed at runtime. This involves directory searching and path resolution using find, sort, and cat in local directories such as ~/.claude/plugins/cache and /mnt/skills/user.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its pipeline that reads and processes project configuration and source files (e.g., package.json, build.gradle, Package.swift, .html, and .swift).
Ingestion points: Project metadata, dependency files, and source code accessed during the SCAN phase.
Boundary markers: The skill lacks explicit delimiters or instructions to prevent the agent from following directions embedded within the scanned files.
Capability inventory: The skill has access to powerful tools like Bash, Edit, and Write, which could be exploited if malicious instructions are processed.
Sanitization: No sanitization or validation is applied to the content of the project files before they are read into the agent's context.

cast