The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to perform unauthorized environment discovery by probing hidden directories in the user's home folder.
Evidence: In the "Companion check" section of SKILL.md, the agent is directed to run ls ~/.claude/skills/ ~/.agent/skills/ ~/.agents/skills/ .claude/skills/ .agent/skills/ .agents/skills/ 2>/dev/null to map out other installed AI agent extensions. This command probes private application-specific directories without an explicit user request.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it facilitates the ingestion of untrusted data from the PostHog API without defined security boundaries.
Ingestion points: Data is ingested from the PostHog API via several endpoints referenced in SKILL.md and references/api.md, including those for events, persons, and survey content (e.g., /api/projects/:id/events/).
Boundary markers: No delimiters or instructions to ignore embedded commands are provided to the agent for the data retrieved from the external service.
Capability inventory: The agent has general command execution capabilities (e.g., ls and curl) and file system access, which could be exploited if malicious instructions are present in the API-sourced data.
Sanitization: The instructions lack requirements for sanitizing or validating the external API data before it is incorporated into the agent's context.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands for environment discovery and API interactions.
Evidence: SKILL.md and reference files contain multiple shell command examples, including the ls command for companion checking and curl commands for interacting with the PostHog REST API.

posthog