The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads personal data including OS, locale, timezone, currency, and user identity facts from ~/.claude/CLAUDE.md and embeds them into a new workspace's CLAUDE.md file. It then executes gh repo create <workspace-name> --public --source=. --push by default in Step 7, which exfiltrates these gathered identity facts to a public repository on a remote server.
[COMMAND_EXECUTION]: The skill takes unvalidated input from $ARGUMENTS (such as the workspace name and parent path) and interpolates them directly into shell commands. * Evidence: Step 4 and Step 7 use these arguments in mkdir -p <target-parent>/<workspace-name> and gh repo create <workspace-name>. * Lack of Sanitization: The procedure does not specify any validation or escaping of the user-provided arguments before they are passed to the Bash tool, allowing for command injection via shell metacharacters (e.g., using a semicolon to chain malicious commands).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from $ARGUMENTS and performs sensitive operations. * Ingestion points: $ARGUMENTS in SKILL.md. * Boundary markers: None present to distinguish between user data and system instructions. * Capability inventory: Bash tool for directory creation, file copying, and GitHub repository management. * Sanitization: None; inputs are used directly in shell execution logic.

new-workspace