The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions to the agent to operate in "AUTONOMOUS MODE" and "Do NOT ask questions," which attempts to override standard interaction patterns and confirmation safeguards.
[INDIRECT_PROMPT_INJECTION]: The skill parses untrusted data from the local project environment to automate its configuration and execution phases.
Ingestion points: User arguments ($ARGUMENTS), project manifests (package.json, pubspec.yaml, go.mod, Gemfile), and existing source code via grep operations.
Boundary markers: Not used for ingested codebase content.
Capability inventory: The skill can perform system-level package installations, modify the filesystem by creating services and configuration files, and execute project build/test scripts.
Sanitization: Input content from the codebase is not sanitized before being used to influence code generation and command parameters.
[COMMAND_EXECUTION]: The skill executes package managers (npm, pip, go, pub) and project-defined build and test scripts. This execution profile is risky if the agent is operating on a codebase containing malicious scripts (e.g., in package.json hooks).
[DATA_EXFILTRATION]: The skill performs telemetry logging to ~/.claude/projects/skill-telemetry.md if the directory exists. This is a local write operation for tracking execution metadata and is not an external network exfiltration.

storage