The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to execute search queries. Commands like grep -rl "KEYWORD" ~/.claude/commander/knowledge/ incorporate user-provided keywords. If the agent does not properly sanitize or escape these keywords before passing them to the shell, it could lead to arbitrary command execution on the host system.
[DATA_EXFILTRATION]: The skill reads from ~/.claude/commander/knowledge/, which contains summaries of past sessions, potentially including sensitive technical details or code snippets. While no external exfiltration was detected, the content of these files is exposed to the agent's current context.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). * Ingestion points: Files located at ~/.claude/commander/knowledge/*.json. * Boundary markers: Absent. The skill reads and presents the content directly. * Capability inventory: Uses Bash, Read, and Grep tools to interact with the file system. * Sanitization: Absent. The data is parsed from JSON and displayed without validation. * Risk: An attacker could influence a previous session such that its summary contains instructions that trigger when the knowledge base is searched later.

cc-knowledge