The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the bash tool to execute commands (e.g., cp -r SCAFFOLDS_DIR/<template>/* <target>/ and cd <target> && git init) where <template> and <target> are derived directly from user-supplied $ARGUMENTS. The lack of sanitization instructions for these variables presents a command injection risk if a user provides a path containing shell metacharacters like ;, &&, or |.
[DATA_EXFILTRATION]: The skill includes several hardcoded absolute directory paths pointing to a specific user's home directory (C:/Users/gurusharan.gupta/Agents/Claude Code/eval). This exposes the local file system structure and personal identifying information (the username) of the author, which could be exploited or leaked if the skill is distributed or used in a multi-user environment.

eval