The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read, analyze, and modify CLAUDE.md, .claude/rules/, and code_map.md files which are often provided by external or untrusted repositories. Because the agent is granted Edit and Write permissions along with repository interaction tools, there is a risk that malicious instructions embedded within these audited files could attempt to influence the agent's behavior during the update process.
Ingestion points: The skill performs discovery and evidence collection by reading all CLAUDE.md and rule files in the workspace or global configuration directory (SKILL.md Phase 1 and 2).
Boundary markers: The skill relies on specific audit rubrics and quality criteria (defined in references/quality-criteria.md) to guide the agent's reasoning, but it does not employ strict technical isolation or delimiters when processing the content of these files.
Capability inventory: The agent has access to Edit, Write, and Bash (limited to git and find) tools, providing it with the ability to modify the filesystem and repository state based on the analysis of potentially untrusted input.
Sanitization: No explicit sanitization or filtering of external file content is described before processing or interpolation into prompts.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool with a scope restricted to git * and find * commands. These are used for discovering context files, verifying claims against the repository manifest, and checking diffs (SKILL.md Phase 1 and 6). While the tool usage is constrained, it permits direct interaction with the host's version control and file tree structure.

claude-context-improver