The Agent Skills Directory

[PERSISTENCE]: The skill includes a bash installation script scripts/install-agents.sh that creates directories and files in the user's home directory (specifically $HOME/.claude/agents and $HOME/.codex/agents). This action persists a custom sub-agent definition across sessions, modifying the global configuration of the agent's execution environment.
[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to run the scripts/install-agents.sh script. This script performs filesystem actions such as creating symbolic links and writing configuration files. The script is also insecurely implemented; it uses an unquoted heredoc (<<EOF) to expand variables into the generated configuration file, which could result in unintended command execution or variable expansion if the source markdown files contained shell-special characters.
[PROMPT_INJECTION]: The sub-agent definition in references/comment-sicko.md uses an aggressive and "deranged" persona to override the base model's standard helpfulness and safety guidelines. The prompt uses strong imperative language like "MUST KILL" and "savor deletion" to force the agent into a destructive behavioral mode where it ignores typical caution regarding the removal of user content.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external code files and diffs provided by the caller, which may contain malicious instructions.
Ingestion points: Files and diffs passed to both the main skill and the sub-agent.
Boundary markers: Absent. There are no delimiters used to separate untrusted code data from the agent's instructions.
Capability inventory: The skill possesses capabilities to delete files, perform code refactoring, and execute local shell scripts.
Sanitization: Absent. The agent does not validate or sanitize the contents of the files it reads before processing them.

no-comments