The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read sensitive local configuration files, specifically ~/.claude/settings.json, to identify configured MCP servers. This file often contains authentication tokens or API keys for various services. While used for tool discovery, reading this file exposes potential secrets to the agent's context.
[PROMPT_INJECTION]: The skill exposes the agent to indirect prompt injection by instructing it to retrieve and evaluate content from untrusted external sources such as npm, PyPI, GitHub, and the open web. Malicious actors could place instructions in package metadata to influence the agent. • Ingestion points: External search results and documentation retrieved during the research phase (SKILL.md). • Boundary markers: Absent; the skill lacks instructions for the agent to treat external content as untrusted data or use delimiters. • Capability inventory: The agent is guided to perform actions like package installation (npm install, pip install) and local filesystem searches (rg). • Sanitization: Absent; no validation or cleaning of external data is specified before the agent evaluates or acts upon it.

search-first