The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses internal agent state files located in the $HOME/.claude/projects/ directory. These files contain sensitive interaction history, project-specific knowledge, and automated memories stored by the agent platform.\n- [COMMAND_EXECUTION]: The skill executes shell commands, including pwd, sed, and grep, to programmatically locate and extract content from the agent's internal memory storage.\n- [INDIRECT_PROMPT_INJECTION]:\n
Ingestion points: The skill ingests untrusted data from both user-supplied pattern descriptions and project memory files found on the local disk.\n
Boundary markers: The workflow does not specify the use of clear delimiters or instructions to ignore embedded commands when passing the extracted data to the secondary skill-extractor agent.\n
Capability inventory: The skill spawns a sub-agent (skill-extractor) and performs multiple file-write operations to the local filesystem to create the new skill structure.\n
Sanitization: Although Step 6 includes a manual quality check for hardcoded credentials in the output, there is no automated sanitization or escaping of the input data to prevent malicious instructions hidden in project memory from controlling the sub-agent's behavior.

extract