The Agent Skills Directory

[PERSISTENCE]: The skill includes an install-aliases command that modifies shell configuration files (~/.bashrc, ~/.zshrc, and ~/.config/fish/config.fish). While documented as its core functionality, writing managed code blocks to shell profiles establishes persistence and alters the user's execution environment.
[COMMAND_EXECUTION]: The shell aliases generated by install-aliases (and the manual examples provided) include the --dangerously-skip-permissions flag. This flag instructs the Claude Code CLI to bypass user confirmation for tool usage, enabling fully autonomous operation that significantly increases the risk if the agent is compromised or redirected by malicious instructions.
[PROMPT_INJECTION]: The generated aliases explicitly set --system-prompt=".". This minimal system prompt can be used to effectively strip away default safety guidelines, operational constraints, and behavioral instructions provided by the platform, leaving the agent vulnerable to jailbreaks or unauthorized behavior.
[INDIRECT_PROMPT_INJECTION]: The skill provides a link feature to share skills/, agents/, and commands/ across all isolated account profiles, creating a cross-account attack surface.
Ingestion points: The link command in scripts/manage-accounts.py moves and symlinks content from individual CLAUDE_CONFIG_DIR folders into a shared ~/.claude directory.
Boundary markers: None. There are no isolation barriers or validation checks when merging skills from different account profiles.
Capability inventory: The skill has the capability to modify shell configuration, create filesystem symlinks, and execute the claude CLI with administrative flags.
Sanitization: The skill does not perform any sanitization or integrity checks on the skills or agents being linked across account boundaries.

accounts