The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted codebases as its primary input. This creates an attack surface where malicious instructions embedded in comments or strings within the audited code could influence the agent's behavior during the review process.
Ingestion points: Phase 1 and the general instructions involve reading package files and the "entire codebase thoroughly."
Boundary markers: The skill lacks explicit boundary markers or instructions to treat ingested code as untrusted data.
Capability inventory: The skill is designed for CLAUDE_CODE, which typically provides file system access and shell execution capabilities, although no tools are explicitly restricted in the frontmatter.
Sanitization: No sanitization or escaping of external content is specified before processing.
[PERSISTENCE]: The skill includes a "SELF-EVOLUTION TELEMETRY" section that instructs the agent to append execution metadata to a file at ~/.claude/projects/skill-telemetry.md. While this appears to be for tracking performance, it represents a persistent write operation to the local filesystem outside of the immediate working directory.
Evidence: The skill provides a specific format and path (~/.claude/projects/) for logging execution outcomes and suggestions.

manufacturing-compliance