The Agent Skills Directory

[PERSISTENCE]: The skill establishes persistent execution on macOS systems by creating a launchd agent. The schedule_on function in scripts/repo_map.py generates a property list (plist) at ~/Library/LaunchAgents/com.claude-code.repo-map-sync.plist and executes launchctl bootstrap to register it as a background service. Additionally, the installation instructions facilitate the modification of the user's ~/.claude/settings.json to register a permanent UserPromptSubmit hook that executes the skill's logic on every prompt.
[COMMAND_EXECUTION]: The script scripts/repo_map.py makes extensive use of the subprocess.run function to invoke system commands, including git for repository metadata extraction and launchctl for service management. These commands operate on paths and data discovered during the filesystem scanning process.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its ingestion of untrusted content from local repositories. Specifically, the readme_summary function in scripts/repo_map.py reads the first line of README.md files from scanned repositories, which is then stored in a cache and injected into the agent's context by scripts/prompt_hook.py.
Ingestion points: Filesystem scan of repository roots, reading README.md contents in scripts/repo_map.py.
Boundary markers: The injected context is prefixed with a descriptive header ("本地仓库地图命中") and followed by instructions, but it does not employ robust delimiters to isolate the untrusted README content from the agent's instructions.
Capability inventory: The skill possesses capabilities for executing git and launchctl commands, reading and writing files within the user's home directory (specifically the ~/.claude directory), and modifying agent configuration files.
Sanitization: The ingested README content is truncated to 80 characters, which limits the potential payload length but does not prevent malicious instruction injection.

repo-map