The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted project files and lock files to generate security configuration recommendations.
Ingestion points: Repository root files, dependency manifests (such as package.json, poetry.lock), and existing .claude/settings.json as defined in references/stack-detection.md.
Boundary markers: The instructions explicitly require user approval before writing any files and mandate the exclusion of destructive system commands.
Capability inventory: The skill utilizes Write, Edit, and Bash tools to modify project configurations and inspect the environment.
Sanitization: The skill includes a verification step to ensure written JSON is valid and does not contain unintended system-level command permissions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to identify the project's technology stack by executing discovery commands like ls and git status. These operations are limited to environment detection and are governed by guardrails in SKILL.MD that prohibit the execution of destructive commands.

update-claude-settings