The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from files at .claude/skills/[name]/SKILL.md to identify failures and propose fixes. This creates a surface where malicious instructions within a targeted skill could attempt to influence the agent's logic during the diagnosis or rewriting process.
Ingestion points: Phase 3 reads the full content of an external skill file.
Boundary markers: The instructions do not specify the use of delimiters or clear separation between the ingested skill data and the improvement logic.
Capability inventory: The skill utilizes Write and Bash tools, allowing it to modify files and execute local commands.
Sanitization: No validation or sanitization of the ingested skill content is mentioned before it is processed for diagnosis.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git checkout in Phase 6 to revert files if improvements are not successful. It also relies on invoking secondary agent commands (e.g., /skill-test) to perform its baseline and retest phases. These actions are scoped to the local repository environment.

skill-improve