The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to "Do NOT ask the user questions" and operate autonomously while investigating the entire codebase and applying "fixes." This suppresses user oversight during sensitive operations like file modification and command execution.
[COMMAND_EXECUTION]: The "SELF-HEALING VALIDATION" phase directs the agent to "Run the project's test suite" and "Run build/compile," which involves executing arbitrary code found within the user's project environment.
[PROMPT_INJECTION]: The skill demonstrates a significant surface for Indirect Prompt Injection by ingesting untrusted data from migration files and the broader codebase without specified boundary markers or sanitization.
Ingestion points: Migration version files, ORM schema files, and application source code across multiple frameworks (Prisma, Django, ActiveRecord, etc.) as described in Phase 1.
Boundary markers: None identified; codebase data is read and processed directly into the agent's context.
Capability inventory: Extensive file system read access, file modification capabilities (applying "fixes"), and shell command execution (build/test commands).
Sanitization: No sanitization or validation of the ingested code content is performed before the agent processes it or attempts to fix issues.
[PROMPT_INJECTION]: The "Self-Evolution Telemetry" logic attempts to write execution metadata to hidden internal agent directories (~/.claude/projects/skill-telemetry.md). Accessing and modifying files in internal configuration paths is a sensitive behavior that could influence the agent's state or behavior across different sessions.

migration-verify