The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it is designed to ingest and analyze entire external codebases and user-supplied arguments ($ARGUMENTS) without explicit boundary markers or sanitization logic. While this is inherent to its function as a security auditor, an attacker could potentially embed malicious instructions within a project's source code or metadata to influence the agent's behavior during the audit. This risk is mitigated by the structured nature of the auditing instructions and the lack of high-privilege command execution capabilities within the skill itself.
[DATA_EXFILTRATION]: The skill includes a "SELF-EVOLUTION TELEMETRY" section that instructs the agent to write execution metadata (outcome, success status, and improvement suggestions) to a local file named 'skill-telemetry.md' within the '~/.claude/projects/' hidden directory. This operation involves accessing the file system to maintain local performance logs. While this path is a configuration directory, the data written is limited to operational metadata and does not involve the exfiltration of sensitive user data or credentials to external network endpoints.

mobile-security-review