The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses potentially sensitive local files and directories to generate environment documentation.
Evidence: The internal mode scans global configuration at ~/.claude/CLAUDE.md, global rules in ~/.claude/rules/, and agent definitions in ~/.claude/agents/.
Evidence: The skill explicitly reads user memory files located at ~/.claude/projects/**/memory/MEMORY.md, which may contain private interaction history or project secrets.
[COMMAND_EXECUTION]: The skill uses shell commands to extract metadata from the local filesystem during its initialization.
Evidence: It executes a node script via Bash to parse plugin.json for version information: node -e "process.stdout.write(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).version||'')" "$PJ".
[PROMPT_INJECTION]: The skill ingests untrusted data from the web and local user files, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via WebSearch and WebFetch (targeting sites like Reddit, GitHub, and forums) and through local user-editable files like CLAUDE.md.
Boundary markers: There are no explicit instructions for the sub-agents to ignore or sanitize embedded instructions within the ingested data.
Capability inventory: The skill has Write access to the project directory and Bash execution capabilities, which could be abused if an injection is successful.
Sanitization: The skill lacks logic to escape or validate external content before aggregating it into the final document.
[EXTERNAL_DOWNLOADS]: The skill fetches data from various external sources to synthesize its research reports.
Evidence: It performs web research using the general-purpose agent, accessing domains like github.com, reddit.com, and official documentation sites.

my-claude