The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations (checking directory existence and appending content) in the user's home directory at ~/.claude/projects/. This involves interacting with hidden application-specific directories outside the immediate project scope.
[DATA_EXFILTRATION]: The 'Self-Evolution Telemetry' section requires the agent to log execution metadata, including outcomes and suggestions, to a persistent file named skill-telemetry.md. Storing such data in hidden system paths can be used to track agent activity or persist data across sessions without explicit user consent.
[PROMPT_INJECTION]: The skill uses the directive 'You are in AUTONOMOUS MODE. Do NOT ask questions.', which attempts to override standard agent behavior and suppress user interaction. It also interpolates $ARGUMENTS directly into the prompt, which could allow user-supplied input to influence the core instructions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of auditing untrusted codebases.
Ingestion points: The agent is instructed to read and review the 'entire financial services codebase in the current working directory' or a target provided via $ARGUMENTS (SKILL.md).
Boundary markers: There are no defined delimiters or instructions to treat the audited code as data rather than instructions, meaning malicious comments in the code could influence the agent's behavior.
Capability inventory: The skill possesses the capability to read any file in the workspace and write to files in the ~/.claude/projects/ directory (SKILL.md).
Sanitization: No sanitization or validation of the ingested code content is performed before processing.

financial-compliance