The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates the execution of various Python scripts located at absolute paths in a hidden home directory (e.g., python ~/.claude/skills/vulnerability-scanner/scripts/security_scan.py .). These scripts are not provided within the current skill package, resulting in the execution of external, unverified code.
[REMOTE_CODE_EXECUTION]: By requiring the agent to run scripts from directory structures it does not control, the skill introduces a vulnerability where malicious files placed at those locations could be executed with the agent's privileges.
[PROMPT_INJECTION]: The skill uses authoritative language such as 'CRITICAL', 'MANDATORY', and 'VIOLATION' to override the agent's operational autonomy and enforce a specific sequence of script executions. This workflow also creates an indirect injection surface:
Ingestion points: The agent reads files and captures all output from external verification scripts (SKILL.md).
Boundary markers: Absent; there are no instructions provided to distinguish between valid script output and malicious content embedded in the processed data.
Capability inventory: The skill has access to Read, Write, and Edit tools, and instructs the agent to execute Python scripts (SKILL.md).
Sanitization: Absent; the agent is directed to capture and summarize all output without validation, filtering, or escaping.

clean-code