The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines a workflow for consuming data from an external 'Inbox' directory without implementing security controls.
Ingestion points: Messages are read from ./.claude/session/messages/{agent}/ and moved to a transaction file for processing.
Boundary markers: No boundary markers or 'ignore' instructions are provided to help the agent distinguish between administrative metadata and potentially malicious payloads within the messages.
Capability inventory: The skill environment allows for bash command execution, background process management, and file system writes.
Sanitization: There is no requirement or guidance for sanitizing the input data before it influences agent actions or script generation.
[COMMAND_EXECUTION]: The skill encourages the creation of executable auxiliary scripts in a shared directory.
Evidence: Instructions in the 'Auxiliary Scripts' section guide the agent to generate and persist shell scripts (e.g., *-runner.sh, {agent}-{purpose}.sh) in the ./.claude/session/ directory.
Risk: These scripts are explicitly stated to be executable by all agents, creating a shared execution surface where malicious instructions ingested via the inbox could be persisted as executable code.

shared-lifecycle