The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to 'grep for key terms FROM the wrong claim'. These search terms are derived from user-supplied hints or recent conversation context. Because the skill does not explicitly instruct the agent to sanitize or escape these terms before passing them to a shell-based search tool, a malicious user could potentially provide a hint crafted to execute arbitrary commands via command injection patterns.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection due to its processing of external and user-supplied data.
Ingestion points: The skill ingests user input via the /scrub command and reads content from various project files including READMEs, source code comments, and planning documents.
Boundary markers: The skill requires a 'Phase 1' confirmation where the agent must state its understanding and wait for user confirmation before proceeding to the search phase, providing a human-in-the-loop safeguard.
Capability inventory: The skill uses shell-based search capabilities (grep) and has the ability to write new markdown files to the scrub-reports/ directory.
Sanitization: The instructions lack specific guidance for sanitizing user inputs or file contents before they are interpolated into shell commands or used to construct filenames (slugs).
[DATA_EXPOSURE]: The skill is explicitly authorized to search through sensitive project locations, including agent memory directories, internal instruction files (e.g., CLAUDE.md, AGENTS.md), and architecture documentation. While this is necessary for its stated purpose, it ensures the agent will be reading and potentially reporting on internal metadata and memory states.

scrub