The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands, specifically bun x --package skills skills add ... and git diff --check.
[COMMAND_EXECUTION]: A command utilizes a hardcoded absolute directory path (/Users/braden/Code/epicenter/.agents/skills). This exposes the host's directory structure and a specific username, which provides information about the host environment.
[EXTERNAL_DOWNLOADS]: The use of bun x --package skills can result in the automatic download and execution of the skills package from a public software registry if it is not present locally. Executing code from unversioned external packages introduces potential security risks.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze instruction files such as AGENTS.md and CLAUDE.md. This creates an attack surface where instructions embedded in those files could influence the agent's behavior. Ingestion points: Reads AGENTS.md, CLAUDE.md, and the .agents/skills directory. Boundary markers: No delimiters or instructions are used to distinguish between the skill's logic and the data being analyzed. Capability inventory: The skill has the ability to execute shell commands using bun and git. Sanitization: There is no evidence of sanitization or validation of the content read from the instruction files before the agent acts upon the analysis.

agent-instruction-hygiene