The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (list-pending-migrations.sh and record-choice.sh) located in the .claude/skills/migration-wizard/scripts/ directory to manage and track the state of migration tasks.
[COMMAND_EXECUTION]: User-provided input (state_key) is interpolated directly into shell commands used for recording user choices (decline/defer). While this is a common pattern for CLI-style skills, it represents a surface area for potential command injection if the input is not validated by the agent or the script.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it dynamically resolves and reads the content of subskills from the filesystem based on user identifiers. This content is then used to inform the agent's behavior during the migration process, though the risk is limited to locally installed files.

mpm-migrate