The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The helper script scripts/ask_fable.sh accesses sensitive configuration and usage files located in the ~/.claude directory (e.g., settings.json, stats-cache.json). These files are used to derive model names but typically contain authentication data or session tokens for the Claude CLI.
[CREDENTIALS_UNSAFE]: The documentation in SKILL.md exposes a hardcoded absolute path (/Users/arnavdas/...), revealing the author's local system username and directory layout.
[INDIRECT_PROMPT_INJECTION]: The skill builds an orchestration packet from untrusted user objectives and workspace context. This packet is processed by an LLM to generate an executable task graph, which could be manipulated by malicious inputs.
Ingestion points: User-provided objectives via the $fable command and workspace information gathered during the orchestration process.
Boundary markers: The skill does not use specific delimiters or sanitization logic when interpolating external content into the orchestration packet.
Capability inventory: The skill uses the spawn_agent tool and runs a local bash script to execute CLI commands with the --permission-mode dontAsk flag.
Sanitization: There is no evidence of validation or escaping for user-supplied objectives or workspace data.
[COMMAND_EXECUTION]: The skill executes a local shell script scripts/ask_fable.sh that calls the claude CLI. The script uses the --permission-mode dontAsk flag, which bypasses user approval for tool execution in the sub-agent environment.
[DYNAMIC_EXECUTION]: The skill generates and executes a task graph at runtime based on LLM output, representing the dynamic execution of logic derived from potentially untrusted inputs.

fable