The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the directory ~/.claude/sessions/ in multiple recipes. This location typically stores the history of all agent interactions, which may contain sensitive code snippets, private project details, or credentials from previous conversations.
[COMMAND_EXECUTION]: Several recipes request broad and unconstrained permissions such as Read(**), Write(**), and wildcard access to powerful command-line tools like gh *, git *, and npm *. This violation of the principle of least privilege allows for a high impact if the agent is misled by malicious input.
[REMOTE_CODE_EXECUTION]: The skill is designed to automatically implement code changes based on external, untrusted sources. Recipe 3 ('Post-Merge Sweeper') executes changes suggested in GitHub PR comments, while Recipe 2 ('Slack Feedback Collector') implements fixes based on Slack messages. This creates a direct path for external actors to inject and execute code within the user's environment.
[PROMPT_INJECTION]: The skill exhibits a high surface area for indirect prompt injection. By processing data from Slack, GitHub comments, and past session logs while maintaining the ability to modify files and run shell commands, an attacker could include malicious instructions in these external feeds to hijack the agent's autonomous loop.

auto-loop-patterns