The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of untrusted agent definition files. An attacker could place a malicious markdown file in the project's ./agents/ directory that, when selected, forces the subagent to perform unauthorized actions.
Ingestion points: Markdown files located in the project local directory (./agents/**/*.md) and the global configuration directory (~/.claude/agents/**/*.md).
Boundary markers: Absent. The skill performs simple string concatenation to build the subagent prompt: "{agent file content}\n\nTask: {task description}".
Capability inventory: The skill utilizes the Agent tool to spawn subagents. Depending on the environment configuration, these subagents may have access to a wide range of tools for file system modification, command execution, and network access.
Sanitization: Absent. The content of the markdown files is used verbatim as the subagent's identity and instructions without any validation or escaping.
[DATA_EXFILTRATION]: The skill accesses the ~/.claude/agents/ directory to discover and read global agent personas. While the access is restricted to markdown files (.md), programmatically accessing hidden configuration directories (~/.claude/) is a sensitive operation that could potentially expose user configuration if the directory structure is abused.
[COMMAND_EXECUTION]: The skill executes the claude agents CLI command to dynamically discover available agents. While this is a native command intended for agent discovery on the platform, automated execution of CLI tools represents an interaction with the host system that should be monitored.

team-builder