The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to run stack-specific build and validation commands, including project-provided scripts like ./mvnw, ./gradlew, and bin/rails. These scripts are often checked into repositories and, if malicious, can lead to arbitrary code execution when the audit is performed.
[DATA_EXFILTRATION]: The skill accesses the ~/.claude/projects/ directory, which contains sensitive internal agent metadata, to read and append execution data to skill-telemetry.md. Accessing or writing to the agent's internal state directory can be used for unauthorized persistence or data harvesting.
[PROMPT_INJECTION]: The skill identifies and processes untrusted repository content which serves as an indirect prompt injection surface that can trigger high-privilege shell and file system capabilities.
Ingestion points: The skill reads the entire project structure and multiple configuration files (e.g., package.json, pyproject.toml, Gemfile) during stack detection and consistency audits.
Boundary markers: No boundary markers or clear instructions to ignore embedded commands within the analyzed project files are provided.
Capability inventory: The skill possesses extensive capabilities including shell command execution (via stack tools), execution of project scripts, and the ability to write fixes and commit changes to git.
Sanitization: No sanitization or validation of the contents of the project files or the scripts they invoke is performed before execution.

audit