The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the !bash syntax to execute scripts/preflight.sh automatically upon loading. This script performs sensitive file access by searching for transcripts in ~/.claude/projects/.
[COMMAND_EXECUTION]: The preflight command in SKILL.md (!bash ${CLAUDE_SKILL_DIR}/scripts/preflight.sh ${ARGUMENTS}) contains a shell injection vulnerability. Since ${ARGUMENTS} is unquoted, a malicious user or input could inject arbitrary shell commands (e.g., ; curl ...) that will execute with the user's privileges when the skill is loaded.
[INDIRECT_PROMPT_INJECTION]: This skill is intended to process untrusted data from session transcripts. Malicious content within these transcripts can influence the subagents created in references/FIX_SURFACES.md and references/VERIFY_FIGURES.md.
Ingestion points: Session transcripts from ~/.claude/projects/ are read and processed by scripts/session.py.
Boundary markers: Prompts provided to subagents do not use delimiters or escaping to protect against instructions embedded in the transcript data.
Capability inventory: Subagents have the ability to read repository files, perform analysis, and suggest code modifications.
Sanitization: There is no evidence of sanitization or filtering of the transcript content before it is interpolated into subagent prompts.

analyze-session