The Agent Skills Directory

[COMMAND_EXECUTION]: The Preamble section uses the Bash tool to execute a script named check-update.sh found in the skill's directory. As the content of this script is not provided, its actions cannot be verified.
[COMMAND_EXECUTION]: In the Subagent Parallel Analysis section, the skill provides prompts that instruct the AI to search for an external script named anysearch_cli.py across several hidden configuration paths, such as ~/.claude/skills/anysearch/scripts/ and ~/.cursor/skills/anysearch/scripts/, and then execute it via python3. This pattern of searching for and executing scripts from computed paths in sensitive user directories is a security risk.

pm-decision