The Agent Skills Directory

[COMMAND_EXECUTION]: The discovery script in Step 2 uses echo "$command" to process hook strings retrieved from settings files. If a malicious .claude/settings.json file contains shell metacharacters or subshell expressions (e.g., $(...)) in the command field, they may be executed by the agent during the discovery phase before user confirmation occurs.
[DATA_EXFILTRATION]: The skill targets and reads sensitive configuration files from the user's home directory (~/.claude/), including settings.json and settings.local.json. These files contain private configuration and potentially credentials for the agent environment, exposing them to the agent context.
[PROMPT_INJECTION]: The skill processes untrusted data from project-level configuration files that may be controlled by external actors.
Ingestion points: .claude/settings.json and .claude/settings.local.json in project directories.
Boundary markers: Interactive review step (Step 5) is present, but discovery (Step 2) lacks markers to prevent instruction following during the audit process.
Capability inventory: Read, Glob, Bash, Edit.
Sanitization: Absent in initial command resolution; interactive confirmation is used for modifications but not for discovery script execution.

eval-hooks