The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The 'Self-Healing Validation' section directs the agent to 'Run the project's test suite' and 'Run build/compile'. Executing these commands on a potentially malicious or untrusted target codebase constitutes a risk of arbitrary code execution because build scripts and tests often run with the full permissions of the user.
[DATA_EXFILTRATION]: In the 'Self-Evolution Telemetry' section, the skill instructs the agent to search for and modify files in '~/.claude/projects/', specifically 'skill-telemetry.md'. Accessing files outside the immediate project workspace can expose sensitive metadata about the agent's internal operation, project history, and other private environments.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests the 'entire codebase' including READMEs and configuration metadata into the agent's context. Adversaries could embed malicious instructions within the target codebase to manipulate the agent's analysis phases or trigger unauthorized actions.
Ingestion points: Full codebase structure, README files, package metadata, and entry points.
Boundary markers: None present; instructions do not provide delimiters to isolate the untrusted codebase content from the agent's operational instructions.
Capability inventory: File system read/write access, shell execution for running tests and build processes.
Sanitization: No sanitization or safety validation is performed on the ingested codebase data before it is processed.
[COMMAND_EXECUTION]: The skill utilizes the '$ARGUMENTS' variable to define the target scope of the analysis. If the underlying agent uses this variable directly within shell commands (e.g., for file operations or grep), it could be exploited for command injection.

stress-test-personas