The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local files that may contain instructions targeting the agent.\n
Ingestion points: The init.mjs script reads project manifests (package.json, go.mod, pyproject.toml) and documentation (CLAUDE.md, README.md) to initialize the project context.\n
Boundary markers: Data is extracted and presented to the agent without delimiting markers or instructions to ignore embedded commands.\n
Capability inventory: The skill has file system write and delete access within its data directory (~/.claude/ck/) and can execute git via spawnSync.\n
Sanitization: No validation or filtering is applied to the content read from external files before it is saved or injected into the session start context.\n- [COMMAND_EXECUTION]: The skill runs system commands to retrieve project information.\n
Evidence: The shared.mjs and session-start.mjs scripts use spawnSync to execute git log, git diff, and git rev-list. These calls are restricted to specific arguments and do not utilize a shell, which provides a degree of protection against arbitrary command injection.

ck