The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash and PowerShell to interact with a specific binary located at ${CLAUDE_PLUGIN_ROOT}/bin/helix. This binary performs sensitive operations including master key creation in the OS keychain, secret injection into subprocesses, and file rendering.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect injection by processing user-provided templates and running shell commands that may incorporate untrusted data.
Ingestion points: The vault render command ingests content from template files, and vault run executes arbitrary command strings provided in the prompt context.
Boundary markers: The instructions lack specific delimiters or warnings for the agent to ignore potentially malicious instructions embedded within templates or command outputs.
Capability inventory: The skill has the capability to write to the file system (vault render --out), execute subprocesses with injected environment variables (vault run --with), and access the system keychain via the helix binary.
Sanitization: The skill documentation highlights that while shell output is masked, direct file access to rendered secrets is unmasked, which is a significant bypass of the intended security model.

vault