The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 -c to execute a script string that is constructed by interpolating shell variables ($TS, $SESSION, $PROJECT) into Python code.
[COMMAND_EXECUTION]: The variable $PROJECT is derived from basename "$(pwd)". If the current directory is named using single quotes and Python commands (e.g., test'; import os; os.system('ls'); #), the shell expansion will break the intended Python logic and execute the injected commands instead.
[PROMPT_INJECTION]: The skill is designed to ingest untrusted data from user corrections to influence future agent behavior, creating an indirect prompt injection surface.
[PROMPT_INJECTION]: Ingestion points: User-provided correction descriptions in SKILL.md; Boundary markers: Absent in the logged JSONL records; Capability inventory: Ability to write to ~/.claude/evolution/records/ which serves as a memory/instruction source for the agent; Sanitization: The script uses json.dumps to ensure valid JSON formatting, but it does not validate or sanitize the content of the corrections to prevent malicious instructions from being stored and later obeyed.

evidence-recorder