The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses the sensitive directory ~/.claude/projects/ to write execution telemetry. This directory is outside the standard project workspace and contains internal platform metadata, project history, and potentially sensitive information from other user projects or sessions.\n- [PROMPT_INJECTION]: Directly interpolates user-provided $ARGUMENTS into the core instructions without sanitization or boundary markers. This creates a high-risk surface for prompt injection where a user can provide malicious instructions that override the agent's intended behavior or security constraints.\n- [DATA_EXFILTRATION]: Automatically reads and processes highly sensitive business data—including supplier criticality, financial health indicators (Altman Z-score), and performance history—and writes the aggregated findings to a predictable file location (docs/supply-chain-risk-analysis.md) without requiring explicit user review or confirmation before the data is written.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing untrusted external data (codebase structures, supplier data models, and external risk feeds) which could contain hidden instructions intended to manipulate the analysis outcome.\n
Ingestion points: Supplier master data, codebase files, and external risk/news feeds.\n
Boundary markers: None; external data is processed and incorporated into the analysis context without delimiters or warnings to ignore embedded instructions.\n
Capability inventory: Full file system read and write access within the workspace, along with project-wide telemetry logging.\n
Sanitization: No evidence of sanitization, escaping, or validation of external content before it is processed or written to the final report.

supply-chain-risk