The Agent Skills Directory

[PROMPT_INJECTION]: The instructions include phrases such as "You are in AUTONOMOUS MODE. Do NOT ask questions," which attempt to override the agent's standard safety guidelines and interactive conversational protocols.
[PERSISTENCE]: The skill contains a "SELF-EVOLUTION TELEMETRY" section that instructs the agent to write execution metadata to ~/.claude/projects/. This targets a hidden directory in the user's home folder typically reserved for platform configuration and state, representing a persistence mechanism or unauthorized data logging.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze arbitrary source code from the current working directory. This creates a high-risk surface for indirect prompt injection, as malicious instructions hidden within the code being audited could influence the agent's behavior during the analysis phase.
Ingestion points: Files in the current working directory and user-supplied arguments (SKILL.md).
Boundary markers: None. The skill does not instruct the agent to use specific delimiters or ignore embedded instructions when reading target files.
Capability inventory: The skill uses the agent's file system reading capabilities and is designed to report findings back to the user.
Sanitization: None. The skill does not provide instructions for sanitizing or escaping the content read from the target project before processing it.

pentest