The Agent Skills Directory

[COMMAND_EXECUTION]: The dir-jail.sh hook script template for Claude Code contains a shell-to-python command injection vulnerability.
Evidence: In templates/claude/hooks/dir-jail.sh, path resolution is performed using: RESOLVED=$(python3 -c "import os; print(os.path.realpath('$TARGET'))" 2>/dev/null || echo "$TARGET").
Risk: The $TARGET variable, derived from user-controlled tool inputs, is interpolated directly into a Python string literal. A path containing a single quote followed by Python code can execute arbitrary logic in the agent's environment.
[DYNAMIC_EXECUTION]: The security architecture relies on the runtime execution of shell and Python scripts to enforce jail boundaries.
Evidence: The skill implements a 'two-layer hook architecture' using block-all.sh and dir-jail.sh scripts to intercept and validate tool calls.
Risk: The reliance on ad-hoc script execution for critical security logic, especially with identified injection flaws, undermines the intended lockdown.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of environments that process untrusted data through unsanitized instruction scaffolding.
Ingestion points: User-provided 'Purpose' and 'Source content' are gathered in Step 1 and written into CLAUDE.md, AGENTS.md, and .gemini/GEMINI.md.
Boundary markers: Absent. The generated files do not include delimiters or instructions to treat scaffolded content as untrusted data.
Capability inventory: The scaffolded workflows utilize Read, Write, Edit, Bash, and Glob tools.
Sanitization: Absent. Requirements gathered from the user are not validated or escaped before being committed to the workflow instruction files.

create-locked-down-skill