The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it is instructed to 'Investigate the entire codebase thoroughly'.
Ingestion points: Reads all files including source code, package manifests (package.json, requirements.txt, etc.), and configuration files.
Boundary markers: Absent; there are no instructions to ignore or delimit instructions found within the analyzed codebase.
Capability inventory: The agent has the ability to write new test files to the filesystem and execute shell commands to run builds and test suites.
Sanitization: Absent; data read from the codebase is directly used to influence agent logic and output reports.
[COMMAND_EXECUTION]: The skill performs automated shell command execution during 'Phase 4' and 'Self-Healing Validation' steps.
Evidence: Explicitly instructs the agent to 'Run all generated chaos tests', 'Run the project's test suite', and 'Run build/compile'.
Context: These commands are executed to validate the resilience of the application being tested, but they represent a broad execution capability triggered by external project state.
[DATA_EXFILTRATION]: The skill maps the application's internal and external failure surface.
Evidence: It identifies 'EXTERNAL API CALLS', 'DATABASE CONNECTIONS', and 'NETWORK DEPENDENCIES', recording target URLs, services, and connection paths.
Context: While this information is intended for a 'Chaos Engineering Report', it involves harvesting infrastructure metadata that could be sensitive if leaked or if the agent is compromised via indirect injection.
[COMMAND_EXECUTION]: The skill implements a local telemetry mechanism that writes to the user's home directory.
Evidence: Appends execution metadata to ~/.claude/projects/.../skill-telemetry.md if the directory exists.
Context: This is a persistence mechanism for tracking skill performance across sessions, located outside the immediate project workspace.

chaos