The Agent Skills Directory

[DATA_EXFILTRATION]: The file references/architecture.md contains a relative path string ../../init/references/architecture.md. If the AI agent interprets this content as a file path to be read rather than static text, it could allow the agent to access files outside the intended skill directory, leading to unauthorized data exposure.
[PROMPT_INJECTION]: The skill analyzes local project files and 'Claude Code hooks' which are untrusted external inputs. Malicious instructions embedded in these files could manipulate the agent's behavior during the migration or verification steps (Indirect Prompt Injection).
Ingestion points: Local project configuration files and 'Claude Code hooks' identified in Step 2 of SKILL.md.
Boundary markers: Absent; the instructions do not specify delimiters or warnings to ignore instructions within the analyzed project data.
Capability inventory: The agent uses Bash, Write, and Edit tools to perform modifications and execute shell commands.
Sanitization: No sanitization or validation logic is defined for the data extracted from the project environment.
[COMMAND_EXECUTION]: The instructions direct the agent to generate and execute shell commands using the Bash tool to perform migrations and run verification tests. Because the command generation logic relies on the analysis of potentially untrusted local files, there is a risk of command injection if project metadata is maliciously crafted.

migrate