The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill employs the dynamic context syntax (!command) within SKILL.md to execute several shell commands automatically when the skill is loaded. These include file listing (ls), path discovery (pwd), and file reading (cat), which run before any user interaction.
[DATA_EXPOSURE]: A specific dynamic context command uses Python to parse .claude/settings.json. While the command is written to only extract keys from the mcpServers object, it represents automated runtime access to project-level configuration files which may contain sensitive environment settings or service names.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading untrusted data from the local project environment (such as package.json content and workspace structures) and using that data to rewrite the instructions and configuration blocks of other agent files. This creates a potential vulnerability surface where malicious content in project metadata could influence the behavior of the adapted skills.
Ingestion points: package.json, .claude/settings.json, and lockfiles read via dynamic context in SKILL.md.
Boundary markers: The skill contains a <boundaries> section with explicit instructions on what the agent may and must not edit, though these act as instructions rather than technical sanitization of the input data.
Capability inventory: The skill utilizes Bash for file system operations, directory listing, and script execution (node, python3), and it is designed to perform surgical edits on markdown files within the plugin directory.
Sanitization: No explicit sanitization or validation of the content ingested from the project files is defined before it is used to rebuild the <domain_areas> and <skill_map> sections.

codebase-adapter