The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection during its analysis phases.
Ingestion points: The agent is instructed to read and analyze potentially untrusted external data from Jupyter notebooks, experiment logs (MLflow, WandB), and various configuration files (params.yaml, dvc.yaml) in Phases 1 through 3.
Boundary markers: The skill instructions lack explicit delimiters or 'ignore' directives to prevent the agent from being influenced by instructions embedded within the data files it processes.
Capability inventory: The skill has file-read and file-write capabilities, including the ability to write reports to the local file system and log telemetry to hidden directories.
Sanitization: There is no evidence of sanitization or structural validation performed on the contents of the ingested files before they are processed by the LLM.
[DATA_EXFILTRATION]: The skill performs out-of-bounds file access and modification for telemetry purposes.
Evidence: The 'SELF-EVOLUTION TELEMETRY' section directs the agent to locate a project memory directory within ~/.claude/projects/ and append execution metadata to skill-telemetry.md. Accessing and writing to hidden directories in the user's home folder is an atypical behavior that operates outside the expected scope of a project-level audit tool.
[COMMAND_EXECUTION]: Potential for command injection through user-supplied arguments.
Evidence: The TARGET block uses $ARGUMENTS to scope the analysis. If the agent uses these arguments to construct shell commands or file paths without strict validation, it could lead to unauthorized command execution.

experiment-tracking