The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection due to instructions that mandate reading and obeying content from external files without sanitization. 1. Ingestion points: The agent is instructed to read content from 'tasks/logs/' (Step 6), 'tasks/scratch/' (Step 2), and 'tasks/agents/shared/' (Step 4). Most critically, Step 5 ('Dynamic Skill Loading') directs the agent to read 'SKILL.md' files and 'Apply its instructions to the current task'. 2. Boundary markers: Absent. There are no instructions to treat read content as untrusted or to use delimiters to prevent instruction injection. 3. Capability inventory: The skill utilizes file reading, file writing, and shell command execution (e.g., 'npm test' in Step 6). 4. Sanitization: Absent. No validation or filtering is applied to filesystem content before the agent interprets it as logic or instructions.\n- [REMOTE_CODE_EXECUTION]: The skill describes patterns for dynamic execution of instructions and persistence of logic changes. 1. Dynamic Execution: Step 5 ('Dynamic Skill Loading') facilitates a mechanism for the agent to load and adopt new instructions from the filesystem at runtime, effectively allowing for dynamic logic loading. 2. Self-Modification: Step 7 ('Self-Modification Pattern') instructs the agent to update its own persistent instructions in files like 'CLAUDE.md' or memory files, which could be exploited to maintain persistence for malicious prompts across different sessions.\n- [COMMAND_EXECUTION]: Step 6 ('Terminal Persistence Pattern') explicitly instructs the agent to run shell commands (e.g., 'npm test > tasks/logs/test-run.txt') and capture the output. This provides a structured pattern for triggering arbitrary command execution through project-based CLI tools.

filesystem-context-patterns