The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses internal agent configuration files, specifically ~/.claude/plugins/installed_plugins.json and ~/.claude/settings.json, to map the user's installed tools and active assets. Furthermore, Step 3-c performs "outward calls" (network operations) to search for prior art based on the local environment's synergy pairs. While the skill instructs the model to abstract queries, this still transmits information derived from the internal project structure to external destinations.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to inspect the file system, list directory contents, verify git environment states via git rev-parse, and execute local scripts such as scripts/mapped_tracks.sh to determine the count of mapped harnesses.
[DYNAMIC_EXECUTION]: In Step 7-1, the skill generates and executes Python code at runtime using python3 -c to parse the agent's JSON-formatted plugin inventory file, which is a form of dynamic code generation and execution.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its ingestion of data from potentially untrusted sources.
Ingestion points: It reads content from LOCAL_SKILL_REGISTRY.md (a user-maintained file), CLAUDE.md, README.md, and data returned from external "outward calls" in Step 3-c.
Capability inventory: The skill possesses significant capabilities, including shell command execution, arbitrary file reading, and dynamic Python execution.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat ingested data as untrusted or to ignore embedded instructions.
Sanitization: The skill lacks validation or sanitization mechanisms for the data it ingests before processing it or using it to drive subsequent actions.

cross-ecosystem-synergy-detection