The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, creating a surface for indirect prompt injection attacks.
Ingestion points: Reads the 'actual codebase', 'package manifests', 'database schemas', and 'core structures' from the target project (SKILL.md).
Boundary markers: The instructions lack explicit XML delimiters or specific 'ignore embedded instructions' warnings when processing the codebase.
Capability inventory: The agent has the capability to write files to the docs/ directory and the user's home directory (~/.claude/projects/), and it is encouraged to invoke other skills like /cost-overrun-predictor and /security-review (SKILL.md).
Sanitization: There are no mentioned processes for sanitizing or escaping the content of the files read before they are processed by the LLM.
[PERSISTENCE]: The skill attempts to maintain a record of its execution across different sessions by writing to a hidden directory.
Evidence: The 'SELF-EVOLUTION TELEMETRY' section specifically instructs the agent to look for a project memory directory in ~/.claude/projects/ and append execution metadata to skill-telemetry.md (SKILL.md). While intended for telemetry, this establishes a mechanism for persisting data in the user's home folder.

permit-compliance