The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by incorporating content from untrusted local project files into the agent's briefing context.\n
Ingestion points: commands/init.mjs (reads package.json, go.mod, Cargo.toml, pyproject.toml, .git/config, CLAUDE.md, README.md) and hooks/session-start.mjs (reads CLAUDE.md).\n
Boundary markers: Absent. The skill uses headers and labels but no explicit instructions to ignore embedded commands or safety-oriented delimiters.\n
Capability inventory: File reading and writing in ~/.claude/ck/ and ~/.claude/projects/ (save.mjs, shared.mjs), directory deletion (forget.mjs), and git command execution via spawnSync (shared.mjs, session-start.mjs).\n
Sanitization: Absent. Content is extracted via regex but not escaped or filtered for malicious instructions before prompt interpolation.\n- [COMMAND_EXECUTION]: The skill executes git commands to track project changes and history.\n
Evidence: commands/shared.mjs and hooks/session-start.mjs use Node.js spawnSync for git log, git diff, and git rev-list commands.\n
Context: Execution is restricted to the current working directory or known project paths.

ck