The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in Step 1 provide a shell command template (grep -rni "<keywords>" "$MEMORY_DIR/") that directly interpolates user-provided input into a shell environment. A malicious user could provide input containing shell metacharacters (e.g., $(command) or ; command) to execute arbitrary code on the host machine.
[DATA_EXFILTRATION]: The skill is designed to programmatically access and read from $HOME/.claude/projects/, a sensitive directory containing the agent's internal memory and conversation history. This data often includes private code, configuration details, and potentially hardcoded secrets from previous sessions, which the skill then 'extracts' into portable files.
[DYNAMIC_EXECUTION]: The skill uses complex shell-based path resolution ($(pwd | sed 's|/|%2F|g; s|%2F|/|; s|^/||')) to identify memory locations. Constructing paths and commands dynamically from environment state and user input without sanitization is a high-risk pattern for exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
- Ingestion points: Files located within $HOME/.claude/projects/.../memory/ are read as source material.
- Boundary markers: No delimiters or instructions are provided to the sub-agent to ignore potential malicious instructions embedded within the memory data.
- Capability inventory: The skill spawns a skill-extractor agent with file-write capabilities and references a publishing tool (clawhub).
- Sanitization: There is no logic to filter or sanitize the content retrieved from memory before it is processed by the secondary agent.

extract