The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core logic involves reading and adhering to documentation found in <project>/.claude/standards/ and ~/.claude/standards/. These files are intended to provide coding rules, but because the agent is instructed to obey them, they represent an attack surface for indirect prompt injection if a malicious actor commits instructions to a repository's standards folder.
Ingestion points: The agent reads content from local and project-specific markdown files in defined standards directories.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing these external documents.
Capability inventory: The skill possesses Bash, Write, and Edit capabilities, which could be abused if the agent follows malicious instructions from the ingested documents.
Sanitization: There is no requirement in the instructions to sanitize or validate the content of the standards documents before the agent adopts their rules.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform system operations, including symbolic link-aware directory listings (ls -L, find -L) and the execution of project-specific test suites (e.g., php artisan test). While the instructions discourage complex environment setup, they still allow for the execution of arbitrary local code through the project's own testing framework.
[EXTERNAL_DOWNLOADS]: The skill's YAML frontmatter includes an update field (npx skills update) which, when triggered by the platform, downloads and executes code from the npm registry. While this is a common mechanism for tool updates, it involves the execution of external code from a non-standardized package source.

quick-edit