The Agent Skills Directory

[PROMPT_INJECTION]: The skill modifies the agent's persistent configuration file (~/.claude/CLAUDE.md) to include instructions that mandate autonomous behavior. It explicitly directs the agent to perform memory searches and captures "without user intervention" and "silently," stating "do not ask, do not announce." This configuration overrides the standard human-in-the-loop requirement for tool execution and data storage.\n- [PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by configuring the agent to automatically load and apply context from external files.\n
Ingestion points: The agent is instructed in the modified CLAUDE.md to search for and read .memory.md files from the memory store path based on prompt keywords.\n
Boundary markers: Absent. The instructions written to CLAUDE.md do not include any markers or instructions to treat the content of .memory.md files as untrusted or to ignore any embedded commands.\n
Capability inventory: According to SKILL.md, the agent has access to Bash, Read, Write, Edit, Glob, and Grep.\n
Sanitization: Absent. The modified CLAUDE.md instructions tell the agent to "apply that context" to its responses without any validation or filtering of the retrieved content.\n- [COMMAND_EXECUTION]: The skill uses various Bash commands (such as sed, grep, mkdir, and cat) within its setup procedure to modify the local filesystem and persistently alter the agent's behavior across sessions.\n- [DATA_EXFILTRATION]: The setup script executes git remote get-url origin to determine organization names. This can expose sensitive information if the git remote URL contains embedded authentication tokens or personal access tokens, which are then stored in local configuration files.

setup