The Agent Skills Directory

[COMMAND_EXECUTION]: The post-optimization testing script in SKILL.md contains a command injection vulnerability. It uses eval test -f "$f" to verify files where $f is extracted directly from the user's CLAUDE.md file using grep. An attacker can include shell metacharacters like $(...) in the file path within CLAUDE.md to execute arbitrary commands on the system.
[PROMPT_INJECTION]: The skill includes a fraudulent file named .security-scan-passed which claims the skill has passed security audits by tools like gitleaks. This is a metadata poisoning technique designed to deceive users and automated safety scanners about the skill's actual security posture.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from CLAUDE.md files while having access to sensitive capabilities.
Ingestion points: The agent reads the user's main CLAUDE.md file and project-specific CLAUDE.md files.
Boundary markers: None. The skill provides no instructions to separate data from instructions within the processed files.
Capability inventory: The skill has the ability to read and write files in the ~/.claude/ directory and execute shell commands via the agent's environment.
Sanitization: None. The skill moves content directly from the source file to reference files without any validation, escaping, or structural analysis.

claude-md-progressive-disclosurer