The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and writes to the ~/.claude/projects/ directory to store execution telemetry. Accessing hidden configuration directories in the user's home folder is a sensitive operation that exposes platform-specific metadata.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing untrusted input with high-privilege capabilities. 1. Ingestion points: Untrusted data enters via the $ARGUMENTS variable (text, images, or URLs). 2. Boundary markers: Absent. The skill does not use delimiters or safety instructions to partition the untrusted input from the agent's logic. 3. Capability inventory: The skill performs file system writes, shell command execution (build and test suites), git commits, git pushes, and pull request creation. 4. Sanitization: Absent. There is no validation or escaping of the input content before it influences downstream autonomous actions.

story