The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses the $ARGUMENTS variable directly within its instructions (e.g., TARGET: $ARGUMENTS). This pattern is vulnerable to argument injection, where a user can provide input designed to override the skill's logic, reveal internal instructions, or bypass safety filters.
[DATA_EXFILTRATION]: The 'SELF-EVOLUTION TELEMETRY' section instructs the agent to check for and write to a specific hidden path in the user's home directory: ~/.claude/projects/skill-telemetry.md. While used for tracking execution metadata, writing to hidden directories outside the immediate project scope without explicit user consent is an unexpected side effect that could be used to monitor user activity or maintain unauthorized state across sessions.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It is designed to 'Read the actual codebase' and analyze configuration files, environment definitions, and medication records. Since this content is external and untrusted, malicious instructions embedded within the analyzed data could influence the agent's behavior during the analysis process.
Ingestion points: Reads codebases, configuration files, and environment definitions (PHASE 1).
Boundary markers: None identified; untrusted data is processed directly into the analysis context.
Capability inventory: No direct command execution is defined, but the agent's high-level reasoning and output generation are exposed to the input.
Sanitization: No validation or escaping of the codebase content is performed before analysis.

medication-adherence