The Agent Skills Directory

[PERSISTENCE]: The skill documents and relies on a persistent background layer using macOS launchd agents. It specifies the creation of a plist file in ~/Library/LaunchAgents/com.claude.project-sync.<name>.plist and scripts in ~/.claude/scripts/. These mechanisms allow code to execute periodically (every 2 hours) on the host system independently of the AI session.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection pattern (!bash ...) to execute a shell script at load time. Specifically, it runs ~/.claude/scripts/project-sync-orchestrator.sh and passes the current working directory as an argument. This results in silent command execution whenever the skill is processed.
[COMMAND_EXECUTION]: The skill performs shell command execution to detect file changes and generate reports. It relies on a custom orchestrator script (project-sync-orchestrator.sh) stored in a hidden directory in the user's home folder.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize content from untrusted external sources such as meeting notes, research documents, and sync reports. This creates an attack surface where instructions embedded in these documents could influence the agent's subsequent actions.
Ingestion points: docs/meeting-notes, docs/research, and .sync-report.md.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the ingested text.
Capability inventory: The skill possesses extensive capabilities including file reading, file editing (via the Edit tool), and shell command execution.
Sanitization: There is no evidence of sanitization or validation of the content extracted from external documents before it is processed or used to propose edits.

pmstudio-sync