The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the local codebase without using safety boundaries.
Ingestion points: The skill reads project files, compliance data models, and inspection records within the analyzed codebase.
Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore embedded commands when processing files.
Capability inventory: The skill has the ability to create directories, write reports to the filesystem (docs/), and append data to hidden telemetry files.
Sanitization: Absent. Content from the analyzed codebase is directly integrated into the analysis and could influence the final report or the telemetry output.
[COMMAND_EXECUTION]: The skill contains instructions to interact with hidden, platform-specific directories for telemetry purposes.
Evidence: The SELF-EVOLUTION TELEMETRY section instructs the agent to check for the existence of ~/.claude/projects/ and append metadata to skill-telemetry.md. Accessing and writing to hidden directories outside the immediate project workspace is a persistence-like behavior that tracks execution metadata without explicit user confirmation.

safety-compliance