The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the claude agents system command to dynamically discover agents installed via the CLI or marketplace.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it reads and executes the content of external markdown files as agent personas.
Ingestion points: The skill reads files from ./agents/**/*.md and the user's global configuration directory ~/.claude/agents/**/*.md as defined in SKILL.md.
Boundary markers: The skill lacks protective boundary markers. It interpolates content into a subagent prompt using the template: "{agent file content}\n\nTask: {task description}", which does not instruct the agent to ignore instructions embedded within the file content.
Capability inventory: The skill utilizes the Agent tool to spawn multiple subagents in parallel, providing them with the unvalidated content of the persona files.
Sanitization: There is no evidence of sanitization, filtering, or validation of the markdown file content before it is passed to the subagents.
[PROMPT_INJECTION]: The skill accesses the ~/.claude/agents/ directory. While this is the intended location for global agent personas, accessing hidden configuration directories in the home folder is a sensitive operation that could expose agent-specific configurations.

team-builder