The Agent Skills Directory

[DATA_EXFILTRATION]: The skill constructs file paths using the user-provided $ARGUMENTS (the {name} parameter) and explicitly instructs the agent to use parent directory traversal: ~/.claude/skills/persona/../../../app/personas/{name}.md. This pattern is highly susceptible to directory traversal attacks. An attacker could provide a value like ../../../../../../etc/passwd to bypass the intended directory and read sensitive system files.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading content from external files and instructing the agent to follow them as "guidelines" for the rest of the session.
Ingestion points: Reads files from app/personas/*.md and uses Glob to list files.
Boundary markers: None. The skill lacks delimiters (like XML tags) or instructions to treat the file content as untrusted data.
Capability inventory: The agent has access to Read and Glob tools.
Sanitization: None. The content is loaded directly into the conversation context.

persona