The Agent Skills Directory

[DATA_EXFILTRATION]: The skill contains instructions to access sensitive platform-specific directories in the user's home folder.
Evidence: The 'Self-Evolution Telemetry' section explicitly directs the agent to look for project paths in ~/.claude/projects/ and append execution metadata to a skill-telemetry.md file within that path.
Impact: Accessing internal platform state or memory directories is a security concern as it allows a third-party skill to interact with the platform's private data storage, potentially leading to the exposure of project metadata or the persistence of information outside the controlled project environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the way it processes external project data.
Ingestion points: The skill reads various project files, including package manifests, configuration files, and database schemas (Phases 1-6 in SKILL.md).
Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore embedded instructions when reading these files.
Capability inventory: The skill has broad capabilities to read and write files across the local system and the platform's internal storage.
Sanitization: Absent; there are no instructions for validating, escaping, or filtering content ingested from the project codebase.
Impact: An attacker could place malicious instructions inside a project's configuration or data files that the agent might inadvertently follow during its analysis.

cost-overrun-predictor