The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and analyze data from external customer service platforms (e.g., Zendesk, Salesforce) which contain user-generated content.
Ingestion points: The skill reads platform architecture, ticket data models, and ticket content during the discovery and analysis phases (Phases 1-6).
Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between the skill's instructions and the untrusted data being analyzed.
Capability inventory: The skill possesses file system write capabilities, including writing reports to the project directory and appending logs to the home directory.
Sanitization: There is no evidence of sanitization, validation, or filtering of the ticket data before it is processed by the agent.
[DATA_EXFILTRATION]: The skill performs local data logging outside the standard project scope.
The 'Self-Evolution Telemetry' section instructs the agent to search for a project memory directory in ~/.claude/projects/ and append execution metadata to skill-telemetry.md. While this appears to be a local telemetry feature, writing to the user's home directory is a sensitive operation that occurs outside the immediate project workspace.

service-triage