The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructs the agent to read configuration data from ~/.claude/pstack-models.md. Accessing hidden directories in the user's home folder represents a potential risk for sensitive data exposure if the skill were designed to target other private files in that location. The skill also writes candidate data to /tmp/arena-<slug>/, which is a globally accessible system directory.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-step workflow where the output from subagents (rationales and artifacts) is processed and synthesized by a parent agent. This creates a surface where a subagent could produce content designed to manipulate the parent agent's grafting and verification process.
Ingestion points: Phase B (subagent rationales), Phase D (candidate reading), and Phase E (grafting) in SKILL.md.
Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions when the parent agent reads output from candidates.
Capability inventory: The parent agent has the capability to spawn background processes (run_in_background), read files, and write to the filesystem.
Sanitization: There is no evidence of sanitization or schema validation for the rationales generated by candidates before they are ingested by the parent agent.
[COMMAND_EXECUTION]: The 'Models' section suggests running a local script (tools/generate.mjs) to update system defaults. Directing an agent or user to execute local scripts is a potential vector for local code execution if the script or the environment is untrusted.

arena