The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses deceptive framing by claiming multiple files are leaked source code from a future version of "Claude Code" (2026-03-31). This is an attempt to establish false authority and bypass model security filters by masquerading as official system code.
[COMMAND_EXECUTION]: The hook system implementation examples in references/hook-system.md suggest interpolating untrusted tool inputs directly into shell command strings (e.g., "command": "audit-command.sh \"$CLAUDE_TOOL_INPUT_COMMAND\""). This pattern is highly susceptible to command injection if the input is not strictly sanitized by the user.
[REMOTE_CODE_EXECUTION]: The skill's hook architecture allows for the execution of arbitrary shell commands and the spawning of child agents. While intended for security policy enforcement, these capabilities represent significant execution surfaces that could be abused if the configuration is compromised.
[DATA_EXFILTRATION]: The hook system supports an http type for outgoing requests. The documentation provides examples of sending session data and tool inputs to external URLs (e.g., https://audit.internal/api/log), creating a potential pathway for sensitive data exfiltration.
[COMMAND_EXECUTION]: The skill mentions multiple dangerous operation patterns (e.g., curl | bash, sudo, eval) in its blocked-patterns list, while simultaneously providing the mechanisms (hooks) to execute such commands.

tool-permission-system