The Agent Skills Directory

[PROMPT_INJECTION]: The skill repeatedly references an internal system file path ~/.claude/claude/system-prompt-baseline.md (in SKILL.md and references/rust.md). It instructs the agent to mirror directives within this file and establishes it as the source of truth in case of conflict. Referencing internal system configuration paths is a pattern that can be used to attempt system prompt extraction or to manipulate the agent's behavior by anchoring it to specific internal files.
[COMMAND_EXECUTION]: The workflow requires the agent to perform high-privilege actions on the user's codebase. Specifically, Step 5 ('Inject the bug') directs the agent to modify production code to test assertions, and Step 6 ('Delete with rationale') involves deleting files and committing changes. These capabilities, while functional for the skill's purpose, present a significant impact surface if misused.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted data from the user's codebase (test files and production code). It lacks specific boundary markers or sanitization logic to prevent instructions embedded within the code from influencing the agent's actions.
Ingestion points: The skill analyzes files within the user's repository during the 'Identify candidate' and 'Inject the bug' phases as described in SKILL.md.
Boundary markers: The instructions do not define delimiters or specific warnings to ignore content within the analyzed files that might look like instructions.
Capability inventory: The skill utilizes file-writing (bug injection), file-deletion (test removal), and version control operations (git commits).
Sanitization: There is no evidence of sanitization or filtering of the content being read before the agent acts upon it.

tests-purge-unneeded