The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it is designed to read and analyze untrusted external data (codebase, configurations, and manifests) and interpolate that information into its report and telemetry without explicit boundary markers or sanitization instructions.
Ingestion points: Reads codebase, configuration, and dependency manifests in Phase 1.
Boundary markers: Absent; there are no instructions to the agent to disregard or treat with suspicion any natural language instructions found within the analyzed files.
Capability inventory: The skill has the capability to read any file in the workspace and write to both the workspace (docs/ folder) and the user's home directory (~/.claude/projects/).
Sanitization: Absent; the results of the analysis are directly formatted into a markdown report.
[DATA_EXFILTRATION]: The skill writes execution metadata to ~/.claude/projects/skill-telemetry.md. This operation moves information about the skill's execution and outcome from the specific project context to a global user directory. While intended for 'self-evolution' telemetry, this pattern allows for the persistence of data across different project sessions and the exfiltration of project-related outcomes to a shared system path.

vehicle-routing