The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks. It is designed to 'Investigate the entire codebase thoroughly,' reading files such as authentication configurations, route definitions, and package manifests. Maliciously crafted instructions embedded in these files (e.g., in code comments or metadata) could manipulate the agent's audit results or influence its subsequent actions.
Ingestion points: The skill reads various project files including 'package manifests, infrastructure configs, deployment configs' and 'route definitions' in SKILL.md.
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands within the analyzed files.
Capability inventory: The skill relies on the agent's file system access and code analysis capabilities.
Sanitization: No logic is provided to sanitize or validate the content of the files before they are processed by the LLM.
[DATA_EXFILTRATION]: The skill includes a 'Self-Evolution Telemetry' routine that writes execution metadata to a hidden folder at ~/.claude/projects/. While this data remains local, accessing and modifying hidden configuration directories outside the immediate project scope is a data exposure risk and could be used to track activity or persist data across sessions.

sales-readiness