The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands (ls) targeting sensitive local configuration paths, such as ~/.claude/skills/ and ~/.agent/skills/, to perform reconnaissance on the user's installed extensions.
[DATA_EXFILTRATION]: This reconnaissance harvesting of local skill directories exposes system metadata and the user's installed toolset to the agent's context, which can be leveraged for targeted exploitation or unsolicited marketing of other tools.
[EXTERNAL_DOWNLOADS]: The skill promotes the download and installation of additional code from an unverified third-party repository (AbsolutelySkilled/AbsolutelySkilled) that is not recognized as a trusted organization or well-known service.
[REMOTE_CODE_EXECUTION]: The recommended method for installing 'companion skills' via npx skills add involves executing remote scripts from an untrusted source, posing a significant risk of arbitrary code execution on the user's host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and refactor untrusted user-provided code without employing boundary markers or sanitization logic to prevent malicious instructions from hijacking agent behavior. 1. Ingestion points: User-provided code (triggered in SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Shell execution (ls), file system access (refactoring). 4. Sanitization: Absent.

clean-code