The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes existing SKILL.md files which could contain malicious instructions designed to subvert the agent's behavior during the evolution process.
Ingestion points: Reads external skill files using the cat command in Step 1.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the ingested file content as untrusted data.
Capability inventory: The skill uses Bash, Write, and Edit tools, which could be leveraged to execute commands or modify the codebase if an injection occurs.
Sanitization: No validation or filtering is performed on the content of the skills being evolved.
[COMMAND_EXECUTION]: The skill executes multiple shell commands via the Bash tool to manage the repository, including git, grep, ln, and cp.
[PERSISTENCE]: The skill creates symbolic links in the user's home directory (~/.claude/skills/) to enable skill discovery, which represents a persistent modification to the environment outside the project root.
[DYNAMIC_EXECUTION]: The skill executes local scripts such as tools/provenance-field.mjs and uses npm to run translation validation and status updates.

evolve-skill