The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It is instructed to autonomously scan the entire codebase and execute build/test commands based on its findings with the directive "Do NOT ask the user questions. Investigate the entire codebase thoroughly." Maliciously crafted instructions embedded in comments or code within the scanned project could potentially hijack the agent's flow.
Ingestion points: The agent reads all source files, configuration files (e.g., package.json, requirements.txt), and project metadata.
Boundary markers: No explicit delimiters or warnings are used to differentiate between the skill's logic and the untrusted data (the code) it processes.
Capability inventory: The skill can execute shell commands for building, compiling, and running test suites.
Sanitization: There is no evidence of sanitization or filtering applied to the content of the files being scanned before they are processed by the LLM.
[COMMAND_EXECUTION]: The "Self-Healing Validation" phase involves executing the project's test suite and build commands (e.g., npm test, make, cargo build). While this is standard functionality for a QA tool, it grants the agent the ability to execute arbitrary scripts defined within the codebase's configuration files, which could be exploited if the codebase contains malicious build instructions.
[DATA_EXFILTRATION]: The skill accesses and writes to a specific path in the user's home directory (~/.claude/projects/) to record "Self-Evolution Telemetry." Although this data is stored locally and appears intended for internal skill improvement, it involves accessing hidden directories outside the immediate workspace.

code-smell