The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and follows coding standards from the project's local directory (<project>/.claude/standards/). This creates a vulnerability where malicious instructions embedded in these files could manipulate the agent's behavior during the editing process.
Ingestion points: Project-specific standards files referenced in SKILL.md and references/standards.md.
Boundary markers: Absent; the agent is instructed to treat these documents as the authoritative source for the team's conventions.
Capability inventory: The skill has access to Read, Write, Edit, Grep, Glob, and Bash tools, providing a wide surface for potential misuse if the agent is manipulated.
Sanitization: None; the skill is directed to open and apply the standards directly to the code.
[COMMAND_EXECUTION]: The instructions direct the agent to run existing tests using the Bash tool. In a compromised repository, these tests could contain malicious code that is executed with the agent's privileges.
[DATA_EXFILTRATION]: The skill is configured to read from a hidden directory in the user's home folder (~/.claude/standards/). This exposes configuration and potentially sensitive data stored in the user's private space to the agent.
[EXTERNAL_DOWNLOADS]: The skill metadata contains an update instruction (npx skills update) which directs the execution of a package from the NPM registry that is not part of a verified vendor list.

quick-edit