The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Auto-Create' feature (Mode 4) triggers on unknown slash commands and attempts to 'infer intent' from the command name and conversation history, executing the inferred action immediately without prior user confirmation. This creates a significant risk of arbitrary command execution if the agent misinterprets input or follows malicious instructions.
[COMMAND_EXECUTION]: The skill's primary function (Mode 2) is the dynamic generation of new executable SKILL.md files containing shell script blocks. This establishes a self-modifying environment where the agent generates and later executes its own code, which can be manipulated to run dangerous commands.
[DATA_EXFILTRATION]: The 'List' and 'Cleanup' modes (Modes 1 and 5) access and parse session log files located at ~/.claude/projects/*/*.jsonl. These files contain full conversation histories, project details, and potentially sensitive code or credentials, exposing this data to the agent's active context.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the 'Auto-Create' logic. By providing specific text in the conversation or using a specially crafted unknown command name, an attacker could manipulate the 'intent inference' process to trigger unintended actions.
Ingestion points: Unrecognized slash commands from user input and historical conversation data retrieved from project .jsonl files.
Boundary markers: None identified; the skill processes inferred intent directly.
Capability inventory: File system operations (mkdir, mv), shell command execution, and directory traversal.
Sanitization: There is no evidence of sanitization for command names, inferred instructions, or arguments before they are written into new executable skill files.

create-shortcut