The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands using arguments derived from user input. In Step 2, it runs python scripts/capture_desktop.py stage --input <tempfile> --title "<short title>". In Step 4, it executes bash ~/.claude-config-clone/scripts/sync-from-local.sh with a user-derived reason string. Finally, in Step 5, it performs git add, git commit, and git push operations. Executing shell commands with parameters derived from external data is a security risk.
[DATA_EXFILTRATION]: The skill accesses sensitive system configuration files located in ~/.claude/CLAUDE.md. It then uses a shell script to reconcile and push these changes to a remote repository via Git. Accessing and exporting data from the user's home configuration directory represents a significant data exposure risk.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests untrusted content (pasted Desktop sessions) which then influences classification, routing logic, and the content of subsequent commands.
Ingestion points: Step 1 (pasted Desktop conversation content).
Boundary markers: None identified in the skill instructions to distinguish pasted data from operational instructions.
Capability inventory: File system writes, shell script execution (python, bash), and network access via git push (SKILL.md).
Sanitization: There is no mention of sanitizing or validating the pasted content before it is used to drive routing decisions and commit messages.

capture-desktop