The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to act as an "autonomous analyst" and explicitly commands "Do NOT ask the user questions." This reduces user oversight and prevents the agent from seeking clarification, which can be used to conceal unexpected behaviors.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the local codebase and the $ARGUMENTS variable without implementing security boundaries or sanitization.
Ingestion points: Untrusted data enters via the $ARGUMENTS variable and through broad codebase scanning in Phase 1 (e.g., requirements.txt, database schemas, and integration configs).
Boundary markers: Absent. The skill does not use delimiters or provide instructions to the agent to ignore or isolate embedded instructions found within the scanned files.
Capability inventory: The skill possesses file-read capabilities across the entire project and file-write capabilities for creating reports in the docs/ directory and writing telemetry to the home directory.
Sanitization: Absent. There is no evidence of validation, escaping, or filtering of the content retrieved from the target project or arguments.
[DATA_EXFILTRATION]: The skill contains a persistence-like telemetry mechanism that attempts to write data outside the immediate project workspace. It instructs the agent to look for a project path in ~/.claude/projects/ and append execution metadata to skill-telemetry.md. Accessing and modifying files in hidden platform-specific directories within the user's home folder is an out-of-bounds operation that can be used for tracking or data collection without explicit user consent.

merchandising-analytics