The Agent Skills Directory

[DATA_EXFILTRATION]: Access to sensitive configuration files. The skill instructs the agent to access /hosthome, which is defined as containing "Home directory, configs, dotfiles". These locations frequently house sensitive credentials, such as SSH private keys, AWS configurations, and other private environment variables stored in dotfiles.
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection through project data ingestion.
Ingestion points: The skill reads untrusted external files including CLAUDE.md, README.md, and various markdown documentation found within /hostworkspace projects (via cat and find commands).
Boundary markers: No boundary markers or "ignore instructions" delimiters are implemented when the agent reads and processes these files into its context.
Capability inventory: The agent has full read-write access to /hostworkspace and the ability to execute shell commands like ls, find, and git to discover and modify project code.
Sanitization: There is no evidence of sanitization or validation of the content read from the filesystem before it is processed by the agent.

workspace-access