The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it instructs the agent to ingest and analyze untrusted content from a codebase and user-supplied arguments without using delimiters or boundary markers.
Ingestion points: Untrusted data enters the agent context via the $ARGUMENTS variable in the SCOPE section and through the codebase files read during the discovery and analysis phases (SKILL.md).
Boundary markers: Absent. The instructions do not use XML tags, triple backticks, or explicit instructions to ignore embedded commands within the audited lease data or codebase.
Capability inventory: The agent is authorized to perform file-system discovery (ls, cat, grep), write a comprehensive report to the docs/ directory, and append telemetry data to hidden files in ~/.claude/projects/.
Sanitization: No sanitization or validation logic is present to filter malicious instructions embedded in the audited files before they are processed by the agent.
[DATA_EXFILTRATION]: The skill attempts to access and modify files within the ~/.claude/projects/ hidden directory. While intended for recording execution metadata (telemetry), accessing hidden application-specific directories outside the immediate project workspace is a sensitive operation that can be used to harvest session information or maintain persistent state across different projects.

lease-optimizer