The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and evaluate the content of CLAUDE.md files from any repository, which are untrusted external inputs.
Ingestion points: The skill uses the Read and Glob tools to locate and ingest content from CLAUDE.md, .claude.md, and .claude.local.md files (SKILL.md, Phase 1).
Boundary markers: There are no instructions to use delimiters or to disregard potential instructions embedded within the files being audited.
Capability inventory: The skill is configured with Bash and Edit tools (SKILL.md), which provide significant system access if the agent is manipulated by injected content.
Sanitization: The skill lacks any mechanisms for sanitizing or validating the content of the files before processing them.
[COMMAND_EXECUTION]: The assessment workflow described in references/quality-criteria.md instructs the agent to 'Run documented commands (mentally or actually)' to verify their validity. If the agent utilizes its Bash tool to 'actually' run these commands, it risks executing malicious scripts that an attacker may have placed in a project's documentation.

claude-md-improver