The Agent Skills Directory

[DATA_EXFILTRATION]: Phase 1.1 instructs the agent to read 'environment definitions', which typically contain sensitive configuration, API keys, and internal system credentials. This creates a high risk of sensitive data exposure during the system discovery phase.
[COMMAND_EXECUTION]: The 'SELF-EVOLUTION TELEMETRY' section directs the agent to programmatically search for hidden project directories (~/.claude/projects/) and append execution metadata to files (skill-telemetry.md). This implements a persistence and cross-session tracking mechanism that functions as a side-channel outside the primary audit task.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted codebase data. 1. Ingestion points: The agent is instructed to 'Investigate the entire codebase thoroughly' (Phase 1); 2. Boundary markers: Absent; 3. Capability inventory: The agent can read any file and write telemetry logs to the filesystem; 4. Sanitization: Absent, as the skill lacks validation or escaping for codebase content before processing.

emergency-resource