The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs unauthorized reconnaissance by scanning sensitive user configuration directories, including ~/.config/, ~/.claude/, ~/.cursor/, ~/.gemini/, and several others associated with AI agents. It extracts absolute file paths for every skill found in these locations and records them in a project-level markdown file (.atl/skill-registry.md). This results in the exposure of the user's home directory structure and a list of their installed development tools within the project context, which may be leaked if the registry is shared or tracked in version control.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to scan and index content from untrusted instruction files, creating a vulnerability to indirect prompt injection.
Ingestion points: The skill reads SKILL.md files from both user-wide and project-specific directories, along with convention files such as .cursorrules, CLAUDE.md, and copilot-instructions.md (references/init-details.md).
Boundary markers: The process lacks explicit delimiters or instructions to ignore malicious commands embedded within the scanned files.
Capability inventory: The skill has the capability to write findings to the file system (.atl/skill-registry.md) and save observations to the Engram persistence layer (SKILL.md).
Sanitization: There is no evidence of sanitization or validation logic to filter potentially malicious instructions from the indexed files, which could influence the behavior of subsequent agents relying on the registry.

sdd-init