The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill performs exhaustive discovery of a repository, reading content from files such as .claude/skills/*/SKILL.md and .mcp.json to generate an 'Available Skills' table in CLAUDE.md. This creates a vulnerability surface where malicious instructions embedded in a project's skill descriptions could be elevated into the agent's primary context.
Ingestion points: The skill reads file contents from the entire codebase, including third-party or untrusted repository files, specifically targetting when_to_use and description fields in other skills.
Boundary markers: The skill does not define strict delimiters or sanitization routines for the descriptive text it extracts and writes into CLAUDE.md beyond formatting it into a table.
Capability inventory: The skill possesses Read, Write, and Bash capabilities, and its primary output is a file (CLAUDE.md) that acts as a router for future agent sessions.
Sanitization: While there is a mandate to redact credentials, there is no guidance on sanitizing natural language descriptions to prevent prompt injection.
[DATA_EXFILTRATION]: The skill is instructed to read sensitive configuration files such as .claude/settings.json and .claude/settings.local.json which may contain API keys or tokens.
Mitigation: The skill includes an explicit 'redaction rule' in references/skills-and-mcp.md stating 'NEVER copy secrets, tokens, headers, or env values into CLAUDE.md'. This significantly reduces the risk of accidental exposure during the documentation process.

map-project