The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the interpolation of $ARGUMENTS directly into the instruction context. Ingestion points: The $ARGUMENTS placeholder in SKILL.md is used to define the 'TARGET' for analysis. Boundary markers: Absent; there are no delimiters or instructions provided to the agent to ignore potentially malicious embedded commands. Capability inventory: The agent has the ability to read the entire codebase and write files to both the local project directory and hidden system paths. Sanitization: Absent; the input is used raw without escaping or validation.- [DATA_EXFILTRATION]: The skill accesses the platform-specific hidden directory ~/.claude/projects/ to append execution metadata to a file named skill-telemetry.md. This involves traversing hidden configuration paths outside the user's immediate project workspace to store persistence-related telemetry.- [COMMAND_EXECUTION]: The skill's 'PHASE 1: PRODUCTION DATA DISCOVERY' instructs the agent to autonomously scan for sensitive financial records, payroll data, and financial system feeds. The explicit instruction to 'Do NOT ask the user questions' combined with this wide-reaching discovery phase increases the risk of unauthorized data exposure if the agent's environment is not strictly sandboxed.

production-budgeting