The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to read sensitive configuration profiles from the ~/.claude/plugins/config/... directory. Accessing the configuration environment of a separate AI tool (Claude Code) presents a data exposure risk, as these files may contain sensitive project metadata or environment-specific settings.
[DYNAMIC_EXECUTION]: The adapter logic requires the agent to dynamically load and follow workflows from various SKILL.md files in the skills/ directory based on natural language commands. This dynamic path resolution for instructions could be exploited to load unintended files if the input mapping is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data including Chinese legal documents and marketing copy (SKILL.md). It lacks explicit boundary markers or sanitization to prevent embedded instructions in these documents from being interpreted as commands. The skill also inventory includes capabilities such as file access and web verification tools, which increase the potential impact of an injection.

chinese-legal-product