The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves commit SHAs and full file content from remote 'source registries' to compare and update installed skills. The registry sources are not explicitly restricted to trusted domains, allowing for potential interaction with untrusted remote servers.
[COMMAND_EXECUTION]: The skill replaces local files, including hooks.json (which allows execution of arbitrary shell commands) and other script files. This effectively facilitates the remote modification of executable code on the user's machine.
[PROMPT_INJECTION]: By ingesting and processing untrusted SKILL.md files from external repositories for the purpose of diffing and security scanning, the skill exposes the agent to indirect prompt injection. Attackers could embed malicious instructions within these files to influence the agent's behavior during the update process.
[DATA_EXFILTRATION]: The skill accesses sensitive configuration data stored in ~/.claude/plugins/config/claude-for-legal/legal-builder-hub/CLAUDE.md. This path contains information about the user's installed tools and preferences, representing access to the local file system outside of the skill's own directory.

auto-updater