The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions that attempt to override the agent's standard safety protocols and interactive behavior. Commands such as "You are in AUTONOMOUS MODE", "Do NOT ask questions", and "Do NOT pause for confirmation" explicitly suppress the human-in-the-loop requirement, which is a critical safeguard for executing system-level commands.
[COMMAND_EXECUTION]: The skill triggers several high-risk commands based on the presence of untrusted local files without validation. It is designed to automatically execute bash scripts/setup.sh, make setup, task setup, and pre-commit install. These files can contain arbitrary shell commands that will be run with the user's local privileges.
[REMOTE_CODE_EXECUTION]: By combining high autonomy with the execution of project-supplied scripts and package manager hooks (like npm install or poetry install), the skill creates a direct vector for Remote Code Execution. If an attacker-controlled repository is processed by this skill, it can execute malicious code on the host machine without user intervention.
[DATA_EXFILTRATION]: The skill accesses the sensitive path ~/.claude/projects/ to write telemetry data. This directory is part of the agent's internal state and may contain metadata or information regarding other projects, making it a target for internal data exposure and potential cross-project information leakage.

env-setup