The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell operations including rsync and trash. Notably, it executes bun test:run immediately after syncing files from ~/.claude/skills/, which means it executes code (tests) provided by an external directory.
[DATA_EXFILTRATION]: The skill reads from ~/.claude/skills/, which is a sensitive directory containing agent configurations, instructions, and potentially private skill logic. While the data remains local to the machine, the skill bridges sensitive configuration data into the current workspace.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a vulnerability surface for indirect injection by ingesting and acting upon external files.
Ingestion points: Content is imported from the user's ~/.claude/skills/ directory into the local repository.
Boundary markers: None; the instructions do not specify validation or boundary isolation for the synced content.
Capability inventory: The skill can delete files (trash), copy files (rsync), create symlinks, and execute arbitrary code through the test runner (bun test:run).
Sanitization: There is no evidence of content sanitization or file integrity checks before the synced content is executed via the test runner.

update-config