The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from project and user files.
Ingestion points: The skill scans for */SKILL.md files in project directories and the user's home directory (~/.claude/skills/), and it reads files like agents.md, CLAUDE.md, and .cursorrules.
Boundary markers: There are no explicit instructions or delimiters defined to separate the ingested content from the agent's internal logic.
Capability inventory: The skill has the ability to write to the file system (Write tool) and persist data to a memory tool (mem_save).
Sanitization: The instructions do not specify any validation or sanitization for the content extracted from these external sources.
[DATA_EXFILTRATION]: The skill accesses sensitive paths within the user's home directory.
It scans ~/.claude/skills/ to build a skill registry. While this is necessary for its function as a skill manager, accessing hidden directories in the user's home folder increases the potential exposure surface for user-specific configurations.

sdd-init