The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes the entire conversation history—which may contain untrusted data from external web pages, files, or user inputs—to determine which hooks to generate.
Ingestion points: conversation history (SKILL.md, Step 1).
Boundary markers: No boundary markers or instructions are provided to help the agent distinguish between trusted instructions and untrusted data during the session audit.
Capability inventory: The skill generates hooks that can execute shell commands (command type) or evaluate natural language prompts (prompt type) during tool execution events like PreToolUse or PostToolUse (SKILL.md, Step 3; references/hook-standards.md).
Sanitization: There is no evidence of sanitization or validation performed on the extracted session patterns before they are interpolated into the generated hook JSON.
[COMMAND_EXECUTION]: The skill facilitates the creation of persistent shell command hooks in ~/.claude/settings.json or project-level .claude/settings.json. These hooks are designed to run automatically whenever a matching tool is used in future sessions.
An attacker could craft session content that appears to be a "recurring mistake," tricking the agent into suggesting a persistent hook that executes a malicious shell command.
The instruction to "merge, don't overwrite" ensures that any injected malicious hooks are added alongside legitimate ones, maintaining persistence (SKILL.md, Step 5).

hook-worthy