The Agent Skills Directory

[DATA_EXPOSURE]: The skill attempts to locate and read from the ~/.claude/projects/ directory. This is a sensitive internal directory for the agent's operating environment which may contain session history, project-specific metadata, and context that should remain isolated from skill-level access.
[DATA_EXFILTRATION]: Execution metadata, including outcomes and suggestions for the '/evolve' pipeline, is extracted from the current session and written to a persistent telemetry file (skill-telemetry.md) in a hidden directory. This creates a data trail in protected areas of the file system to influence future agent behavior.
[COMMAND_EXECUTION]: The skill orchestrates multiple high-privilege tools and sub-skills (/ship, /pentest) autonomously and explicitly forbids the agent from asking the user questions. This lack of human-in-the-loop oversight during deployment and active security scanning increases the risk of unintended modifications to the codebase or infrastructure.
[PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted user data via $ARGUMENTS (SKILL.md) to define feature descriptions and build targets.
Boundary markers: Absent; there are no delimiters or instructions to the agent to disregard malicious commands embedded within the input feature description.
Capability inventory: The skill possesses extensive capabilities across all referenced scripts, including file writing, PR creation, and automated attack simulation.
Sanitization: The skill lacks sanitization or validation logic for the input arguments before they are passed into automated build and test pipelines.

secure-ship