The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating the user-provided <dir> argument directly into a python3 execution string (e.g., python3 ${CLAUDE_PLUGIN_ROOT}/scripts/ring.py scan <dir>). If the environment executing these commands does not properly escape the directory path, it could be exploited to perform command injection by providing paths containing shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill reads and parses file content from a user-specified directory to generate Mermaid diagrams and anomaly reports, creating a vulnerability to data-driven instruction injection.
Ingestion points: Files within the provided <dir> and its subdirectories (like <dir>/done/) are scanned and their contents (e.g., anomalies, slug, carrier fields) are processed by the ring.py script.
Boundary markers: The skill lacks explicit instructions or delimiters to ensure the agent ignores instructions that might be embedded within the project files it reads.
Capability inventory: The skill has access to the Bash and Read tools, allowing it to execute local scripts and interact with the filesystem.
Sanitization: There is no evidence of sanitization or validation performed on the fields extracted from the files before they are presented to the agent or the user.

rings