The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using git log to gather project history and rework patterns. It also attempts to execute a local script at ~/.claude/scripts/sync-backup.sh as part of its logging phase.
[REMOTE_CODE_EXECUTION]: The skill contains a pattern to execute a shell script from a fixed path ~/.claude/scripts/sync-backup.sh. This execution targets a file external to the skill's own package, which could lead to arbitrary code execution if the local environment is compromised or the script contains malicious instructions.
[PROMPT_INJECTION]: The instructions include an explicit directive to bypass human oversight: 'Do NOT ask the user questions. Analyze findings and apply patches autonomously.' This removes the user from the loop when the agent is making significant modifications to its own or other skills' instructions.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection due to its core design of ingesting untrusted project data to influence agent instructions.
Ingestion points: Reads content from recall-*.md, MEMORY.md, metrics-*.md, and git log output.
Boundary markers: Absent. There are no instructions to delimit or ignore instructions that may be embedded in the analyzed data.
Capability inventory: The skill can modify any SKILL.md file in the environment using an Edit tool and can execute shell scripts.
Sanitization: Absent. Findings from data are directly mapped to additive patches in other skills without validation or escaping.

evolve