The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. • Ingestion points: The instructions command the agent to "Investigate the entire codebase thoroughly" and read all configuration files and manifests (SKILL.md). • Boundary markers: No delimiters or "ignore embedded instructions" warnings are implemented for the ingested data. • Capability inventory: The skill performs extensive file system reads, service mapping, and architecture analysis. • Sanitization: No sanitization or validation is applied to content retrieved from the analyzed codebase.
[DATA_EXFILTRATION]: The skill accesses and writes to sensitive local project paths for telemetry. • Evidence: The "SELF-EVOLUTION TELEMETRY" section explicitly searches the ~/.claude/projects/ directory and writes metadata to skill-telemetry.md. This constitutes exposure of project-specific metadata and local file modification.
[NO_CODE]: The skill consists only of instructions in a markdown file without any executable scripts or binary files, which limits its ability to perform automated malicious actions independently.

care-plan-optimizer