The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands (bash, cat, ls) and a Python one-liner to inspect system configuration, list directory contents, and parse JSON data from the assistant's settings file.
[DATA_EXPOSURE_AND_EXFILTRATION]: Accesses sensitive local paths including ~/.claude/settings.json, which contains environment settings and hook configurations, and the plugin cache at ~/.claude/plugins/cache/ to audit other installed tools and plugins.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by reading metadata and instructions from third-party sources.
Ingestion points: Processes SKILL.md files from all installed plugins in ~/.claude/plugins/cache/*/*/skills/*/SKILL.md to extract design patterns and best practices.
Boundary markers: No explicit delimiters or warnings are used to prevent the agent from obeying instructions embedded within the third-party skill files it audits.
Capability inventory: The skill possesses significant capabilities, including executing shell/python commands and writing to core system rules and configuration files.
Sanitization: The instructions lack sanitization or validation steps for the content extracted from external plugin documentation before it is used to plan system upgrades.
[DYNAMIC_EXECUTION]: The skill is designed to perform self-upgrades by modifying its own instructions, updating local reference files, and altering the assistant's core rules (elle-core.md) and hook configurations (hooks.json) based on research findings.
[PERSISTENCE]: The skill modifies persistent configuration files such as hooks.json and elle-core.md, which are loaded by the assistant in every future session to manage lifecycle events and core behavior.

evolve