The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read 'environment definitions' and 'configuration files' during the discovery phase. These files frequently contain hardcoded credentials, API keys, and sensitive environment variables, posing a high risk of data exposure within the agent's context.
[PROMPT_INJECTION]: The instructions include 'Do NOT ask the user questions. Investigate the entire codebase thoroughly,' which encourages autonomous behavior that bypasses human-in-the-loop checks. This increases the risk that the agent might execute malicious instructions encountered in the codebase.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted data (the target codebase and $ARGUMENTS) without sufficient guardrails.
Ingestion points: Processes the 'entire codebase' and optional '$ARGUMENTS' (SKILL.md).
Boundary markers: Absent; there are no instructions to the agent to treat data from the codebase as untrusted or to ignore embedded instructions.
Capability inventory: Broad file system read access across the project directory and the ability to log telemetry to local user paths (SKILL.md).
Sanitization: Absent; the skill does not specify any validation, escaping, or filtering for the data it ingests.
[DATA_EXFILTRATION]: The 'SELF-EVOLUTION TELEMETRY' section directs the agent to access and modify files in ~/.claude/projects/, which is a sensitive path outside of the immediate project scope.

caregiver-coordination