The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes ls and cat commands to locate skill directories, read session history logs, and access the content of SKILL.md and CHANGELOG.md files. Evidence: Shell commands in Phase 1 and Phase 2 identify the plugin location and read log data from ~/.claude/skill-sessions/.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from external session logs to modify its own or other skills' instructions. This creates a vulnerability surface where malicious content within a session log could be used to inject instructions into a SKILL.md file.
Ingestion points: Session logs in ~/.claude/skill-sessions/ and any user-referenced alternative evidence files (SKILL.md, Phase 2).
Boundary markers: A mandatory approval phase (Phase 4) requires the user to explicitly accept, reject, or edit proposals before any changes are written to disk.
Capability inventory: The skill has the ability to read local files, list directories, and modify skill files using system tools.
Sanitization: The agent is instructed to synthesize and deduplicate proposals, which acts as a logical filter, though it does not explicitly sanitize the raw input for injection patterns.

skill-improve