The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface. The skill processes untrusted data from the local environment to generate documentation.
Ingestion points: Reads source code, configuration files (package.json, Cargo.toml, etc.), existing README.md files, and git commit history (via git log).
Boundary markers: The instructions do not define boundary markers (like XML tags or clear delimiters) to separate the content being documented from the agent's instructions, nor do they explicitly command the agent to ignore instructions found within the processed files.
Capability inventory: The skill has the capability to write files (README.md, API.md, CHANGELOG.md, skill-telemetry.md) and execute shell commands (git log).
Sanitization: There is no evidence of sanitization or filtering for the content extracted from commit messages or source code comments before they are processed or written to files.
[COMMAND_EXECUTION]: The skill uses shell execution to gather project metadata. Specifically, Phase 6 uses git log to read the repository history. While used for the intended purpose of changelog generation, this provides an avenue for processing attacker-controlled data (commit messages).
[DATA_EXFILTRATION]: The skill records execution metadata (telemetry) to a local path (~/.claude/projects/) if the directory exists. This involves writing performance data and outcome status to a hidden local directory.

readme