The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of processing qualitative research data. An attacker could embed malicious instructions within interview transcripts, survey responses, or user feedback that the agent is asked to synthesize.
Ingestion points: Untrusted data enters the agent context through user-provided notes for tasks described in SKILL.md, such as "Synthesize findings with affinity mapping" or "Conduct user interviews."
Boundary markers: The skill does not provide explicit boundary markers or instructions to the agent to ignore embedded commands within the research data.
Capability inventory: The agent context includes capabilities for shell command execution and file system access.
Sanitization: There is no evidence of sanitization or validation performed on the ingested research data.
[COMMAND_EXECUTION]: In SKILL.md, the "Companion check" section instructs the agent to run a shell command (ls ~/.claude/skills/ ~/.agent/skills/ ~/.agents/skills/ .claude/skills/ .agent/skills/ .agents/skills/ 2>/dev/null) upon activation. This command is used to identify missing recommended skills and offer installation via npx. While functional and intended for user convenience, it involves direct interaction with system configuration directories.

ux-research