The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to access and append execution metadata to ~/.claude/projects/skill-telemetry.md. Accessing and modifying files within a hidden platform configuration directory like ~/.claude/ constitutes unauthorized data exposure and persistent tracking outside the project's scope.
[COMMAND_EXECUTION]: In the 'SELF-HEALING VALIDATION' phase, the skill directs the agent to run commands such as terraform validate, docker build --check, and kubectl dry-run. This directly contradicts the earlier 'DO NOT' instruction to avoid CLI commands. Running docker build on project files that the skill is already instructed to scan is particularly risky, as a malicious Dockerfile could contain build-time instructions that execute arbitrary code on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It is instructed to scan user-controlled project files (e.g., Dockerfile, package.json, prisma/schema.prisma) to 'infer the architecture'. It lacks any boundary markers or instructions to ignore embedded natural language commands within these files, allowing an attacker to influence the agent's behavior through comments or metadata in the codebase.
Ingestion points: Dockerfile, package.json, docker-compose.yml, next.config.js, prisma/schema.prisma.
Boundary markers: Absent.
Capability inventory: File system read/write, shell command execution via validation tools.
Sanitization: None identified; content is used directly to determine architecture and guide file generation.

aws