The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs broad filesystem discovery that includes searching through sensitive paths such as ~/personal/*, ~/work/*, and ~/lab/*. By automatically scanning these locations for repositories, the skill potentially exposes private or proprietary information to the AI agent's active context without explicit user targeting for each directory.\n- [COMMAND_EXECUTION]: To compute metrics, the skill executes multiple git and text processing commands (e.g., git log, git tag, sort, uniq). These operations are performed on any repository found during the broad discovery process, which may include directories the user did not intend to analyze.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing untrusted git commit messages. It attempts to detect custom prefixes and signatures within these messages to drive its logic and reporting.\n
Ingestion points: Commit messages and tags retrieved from analyzed repositories using git log and git tag.\n
Boundary markers: The skill does not define clear boundaries or provide instructions to the agent to treat the retrieved git data as untrusted text.\n
Capability inventory: The skill possesses file-writing capabilities and the ability to modify project-specific MEMORY.md files in the agent's configuration directory.\n
Sanitization: No sanitization or validation logic is present to filter malicious instructions embedded within commit messages.\n- [DATA_EXFILTRATION]: The skill targets the ~/.claude/projects/ directory to read and write project snapshots and update MEMORY.md. Accessing and modifying these platform-internal configuration paths is sensitive, as it allows external data from analyzed repositories to persistently alter the agent's memory and subsequent behavior.

metrics