The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the user and the agent to use the -ExecutionPolicy Bypass flag when running PowerShell scripts (e.g., in the Stop hook and manual setup instructions). This explicitly overrides system-level security configurations designed to prevent the execution of untrusted or unsigned scripts.
[COMMAND_EXECUTION]: The skill automatically executes local scripts using shell hooks and recommends manual execution of a Python script. Specifically, the Stop hook triggers check-complete.sh or check-complete.ps1, and the SKILL.md instructions prompt the execution of session-catchup.py using the system Python interpreter.
[DATA_EXFILTRATION]: The scripts/session-catchup.py script programmatically accesses internal application data stored in ~/.claude/projects/. These files contain conversation history and session logs. While intended for context recovery, this provides the agent with access to potentially sensitive historical data across different sessions.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to its core design of reading external files and logs.
Ingestion points: The skill frequently reads task_plan.md, findings.md, and progress.md from the project directory, as well as session logs from ~/.claude/projects/ via session-catchup.py.
Boundary markers: There are no delimiters or instructions provided to the agent to treat the content of these files as untrusted or to ignore embedded commands.
Capability inventory: The skill allows the use of powerful tools including Bash, Write, Edit, WebFetch, and WebSearch.
Sanitization: The content of the planning files and session logs is not sanitized or validated before being read into the agent's attention window. If these files are modified by an external process or contain content from a malicious web search, the agent may execute instructions embedded within them during its routine 'plan refresh' cycles.

planning-with-files