The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to automatically execute a shell command (ls) upon activation. This command probes several hidden directories in the user's home and current directory (e.g., ~/.claude/skills/, ~/.agent/skills/) to discover other installed plugins or skills.
[EXTERNAL_DOWNLOADS]: The skill directs the agent to recommend the installation of additional 'companion skills' from an external repository (AbsolutelySkilled/AbsolutelySkilled) that is not part of a known trusted organization. This encourages the user to download and integrate unverified third-party components.
[REMOTE_CODE_EXECUTION]: The recommendation to use npx skills add AbsolutelySkilled/AbsolutelySkilled introduces a risk of remote code execution, as the npx utility fetches and runs code from the npm registry or remote repositories managed by an unverified third party.
[PROMPT_INJECTION]: The skill mandates specific behavioral changes, such as requiring the agent to always start its first response with a specific emoji (🧢) and directing it to perform an automated environment check ('Companion check') which overrides default initialization and forces automated tool use.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by instructing the agent to process untrusted external data (e.g., bank statement descriptions and OCR-extracted invoice content). It lacks specific boundary markers and sanitization guidelines to prevent embedded malicious instructions in financial data from influencing the agent's behavior.
Ingestion points: Bank feed matching and OCR extraction (SKILL.md).
Boundary markers: Absent.
Capability inventory: Shell access for environment discovery and package installation (SKILL.md).
Sanitization: No mention of input validation or escaping for financial data.

bookkeeping-automation