The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to load and apply 'freeform rules' from local markdown files.
Ingestion points: The skill reads instructions from .claude/office.local.md in the current working directory and ~/.claude/office.local.md in the user home directory.
Boundary markers: The instructions do not define any delimiters or system-level warnings to separate user-provided configuration from the core skill instructions, instead telling the agent to merge them as overrides.
Capability inventory: The skill itself contains no executable code or subprocess calls, meaning the risk is limited to the agent's internal reasoning and its available tools.
Sanitization: There is no mention of validation, filtering, or sanitization of the rules loaded from external files.
[NO_CODE]: The skill consists entirely of Markdown and YAML documentation and does not ship with any executable scripts, binaries, or active code components.

tropes