The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands for project discovery and environment scanning.
Runs find . -maxdepth 2 to identify programming languages in the current workspace.
Executes ls ~/.claude/skills/expertise/ to discover other installed expertise skills.
Uses cat to read files from paths derived from project inference (e.g., ~/.claude/skills/expertise/[domain]/references/*.md).
[DATA_EXFILTRATION]: While no direct network exfiltration is present, the skill proactively probes the ~/.claude/ directory, which is a sensitive location containing agent-specific configuration, other skills, and potentially private expertise data. The contents are read into the agent's context where they could be exposed in subsequent responses or searches.
[INDIRECT_PROMPT_INJECTION]: The skill defines a mechanism to load external markdown content from local directories based on detected project domains. This ingestion of untrusted or externally-sourced files into the prompt context creates an attack surface where instructions embedded in those 'expertise' files could influence or override the agent's behavior.
Ingestion points: Reads files from ~/.claude/skills/expertise/[domain]/references/*.md (SKILL.md).
Boundary markers: None used when interpolating the content of the loaded reference files.
Capability inventory: The skill has access to shell execution (find, ls, cat), file system scanning, and web search capabilities.
Sanitization: No evidence of content sanitization or validation before loading reference files into the context.

debug-like-expert