The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user responses from a conversational interface and writes them directly to local markdown files (e.g., identity.md, preferences.md) to establish a personalized context. This behavior creates an attack surface where a user (or an attacker influencing the user's input) could provide malicious instructions that are stored and subsequently followed by the agent in future interactions.
Ingestion points: User conversation input regarding identity, work, relationships, and preferences in SKILL.md.
Boundary markers: Absent; the skill lacks delimiters or warnings to ignore instructions embedded in the saved context files.
Capability inventory: The agent is instructed to perform file-write operations to the ~/.claude/.context/core/ directory.
Sanitization: Absent; there is no mention of filtering, escaping, or validating the input before storage.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to verify the environment and trigger synchronization.
Evidence: Direct instruction to run ls ~/.claude/.context/ in SKILL.md.
Evidence: Instructions to invoke the /sync-context tool or its corresponding script to update core configuration files.

onboard