The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads global user configuration files (including ~/.claude/CLAUDE.md, rules, agents, and skills) and private project memory files (MEMORY.md) and writes their content into documentation stored within the project's local .claude/ directory. This behavior could inadvertently expose global or private user data to third parties if the project directory is shared or committed to a public repository.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external web sources (via WebSearch and WebFetch) and user-controlled memory files to generate documentation. It lacks explicit sanitization or strict boundary markers (such as XML tags or delimiters with warnings) to prevent malicious instructions embedded in these external sources from influencing the documentation process or the behavior of the sub-agents.
Ingestion points: Global configuration files, local project memory files, and web search results from sources like Reddit and GitHub.
Boundary markers: Absent; sub-agents are given prose instructions without strict data delimiters.
Capability inventory: The skill utilizes Read, Write, Agent, WebSearch, and WebFetch tools.
Sanitization: No explicit sanitization or filtering of external content is performed before aggregation.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a node -e command string. This script is used to parse a local plugin.json file to extract version information. While the intent is functional, it involves executing assembled code via the shell.
[DYNAMIC_EXECUTION]: The skill uses node -e to evaluate a JavaScript snippet at runtime to extract metadata. This is used for generating document frontmatter.
[EXTERNAL_DOWNLOADS]: The skill fetches data from external sources including code.claude.com, github.com/anthropics/claude-code, and community forums. These sources are well-known services and are accessed as part of the skill's research functionality.

my-claude