The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests free-form user input and writes it to a persistent profile file (~/.claude/PROFILE.md) intended to be read by other skills to influence their behavior. This creates a vulnerability where malicious instructions stored in the profile could hijack subsequent agent actions.
Ingestion points: User responses collected via the AskUserQuestion tool throughout the interview process in SKILL.md.
Boundary markers: The generated profile markdown does not include delimiters or specific instructions for other skills to treat the content as untrusted data.
Capability inventory: The skill uses the Write tool to persist data to the local file system.
Sanitization: No sanitization or validation is performed on the user-provided strings before writing them to the profile file.
[COMMAND_EXECUTION]: The skill uses the Write tool to modify the local file system at ~/.claude/PROFILE.md. While the scope is restricted to this specific path in the allowed-tools frontmatter, it represents a direct write capability based on external input.

create-profile