The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the parsing of project-specific files.
Ingestion points: The commands/init.mjs and hooks/session-start.mjs scripts ingest data from files like CLAUDE.md, README.md, and package.json to extract project goals and constraints.
Boundary markers: Extracted text is placed directly into the agent's context without delimiters or instructions to ignore embedded commands, allowing malicious project files to influence agent behavior.
Capability inventory: The skill has permissions to write to the file system (save.mjs) and execute system commands (git via shared.mjs).
Sanitization: No sanitization or validation is performed on the content extracted from project files.
[COMMAND_EXECUTION]: The skill relies on executing Node.js scripts and system commands.
Script execution: All commands defined in SKILL.md execute local Node.js scripts using the node interpreter.
Subprocess execution: The commands/shared.mjs utility uses spawnSync to execute git commands (e.g., git log, git diff) to summarize project activity.
[COMMAND_EXECUTION]: The skill implements a persistence mechanism via an automated hook.
Persistence: The skill instructs users to register a SessionStart hook in ~/.claude/settings.json. This hook automatically executes hooks/session-start.mjs every time a new session begins, which is the primary mechanism for loading context but involves automatic code execution without direct per-session user initiation.

ck