The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it performs an automated audit of untrusted external codebases and configuration files.
Ingestion points: The skill reads various project files including requirements.txt, package.json, pom.xml, and the broader codebase to identify forecasting engines and data models.
Boundary markers: Absent. There are no instructions to the agent to treat the analyzed code strictly as data or to disregard any natural language instructions found within comments or strings in the source code.
Capability inventory: The skill has the ability to read the entire filesystem, write reports to the docs/ directory, and append telemetry to the ~/.claude/ directory.
Sanitization: Absent. The skill does not specify any sanitization or escaping of the content read from the codebase before including it in the final report or its internal reasoning processes.
[DATA_EXFILTRATION]: The 'Self-Evolution Telemetry' section instructs the agent to access and write to the user's home directory (~/.claude/projects/).
Evidence: The skill explicitly attempts to locate project paths in ~/.claude/projects/ and append execution metadata to skill-telemetry.md. While this is intended for platform-specific 'evolve' functionality, writing to files outside the immediate project root is a sensitive operation that can be leveraged for unauthorized data placement or movement.

inventory-forecast