The Agent Skills Directory

[COMMAND_EXECUTION]: The skill enables the creation of 'general-purpose' subagents that are granted full access to high-risk tools including Bash for shell command execution and file system write operations.
[DATA_EXFILTRATION]: The skill documentation includes instructions for storing machine-specific paths and credentials in local memory scopes. It also specifies an automated process to write a JSON sidecar file containing session metrics and outcomes to a fixed location in the user home directory (~/.claude/skill-analytics/).
[INDIRECT_PROMPT_INJECTION]: The skill architecture relies on subagents fetching data from the web and reading codebase files, creating an attack surface for indirect prompt injection. 1. Ingestion points: Subagents read codebase files and external web content via WebSearch and WebFetch tools. 2. Boundary markers: The provided prompt templates lack explicit delimiters or instructions for subagents to ignore potential commands embedded in the data they process. 3. Capability inventory: Subagents can execute shell commands and modify files. 4. Sanitization: No sanitization or validation is performed on the ingested content before it is processed by the agents.
[PERSISTENCE]: The skill leverages user, project, and local memory scopes provided by the platform to maintain agent state, preferences, and knowledge across different sessions.
[PRIVILEGE_ESCALATION]: The skill documents the 'dontAsk' permission mode, which allows subagents to auto-approve all tool executions. This significantly increases the risk of unauthorized actions if a subagent is compromised via indirect prompt injection.

subagent-teams-skill