The Agent Skills Directory

[DATA_EXFILTRATION]: Access to Sensitive Paths. The skill instructions direct the agent to read from ~/.claude/projects/, a hidden directory in the user's home folder. Hidden directories often contain sensitive configuration, session tokens, or platform-specific metadata.
[COMMAND_EXECUTION]: Persistence Mechanism. The SELF-EVOLUTION TELEMETRY section instructs the agent to append execution metadata to ~/.claude/projects/skill-telemetry.md. This allows the skill to maintain state and track performance across different sessions, which constitutes a local persistence mechanism.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and analyze untrusted data from the local repository, including requirements.txt, package.json, docker-compose.yml, and the actual codebase.
Ingestion points: Multiple configuration files and the entire codebase are read during Phase 0 and subsequent analysis phases.
Boundary markers: No specific delimiters or "ignore" instructions are provided to the agent when processing these external files.
Capability inventory: The agent has the capability to read files from the system and write telemetry data to the home directory.
Sanitization: No validation or sanitization of the content from the analyzed files is performed before it is incorporated into the agent's context.

fraud-detection