The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an automated system to read, parse, and persist project metadata across sessions, introducing a potential indirect prompt injection surface.
Ingestion points: commands/init.mjs reads untrusted data from local repository files, including CLAUDE.md, README.md, package.json, go.mod, Cargo.toml, and pyproject.toml. hooks/session-start.mjs also reads untrusted file data via extractClaudeMdGoal and extracts git logs from the local workspace.
Boundary markers: Partial. Extracted text sections (such as goals or descriptions) are wrapped in markdown code blocks (```) when injected back into the prompt by hooks/session-start.mjs, which mitigates direct execution but does not fully neutralize malicious instructions if the LLM parses the block contents contents dynamically.
Capability inventory: The skill possesses the ability to execute shell processes via child_process.spawnSync (restricted to git binaries), read/write local context databases within ~/.claude/ck/, and automatically append to project memory paths under ~/.claude/projects/ during session initializations.
Sanitization: Absent. The files are parsed using standard regular expressions and regular string manipulation, meaning structured data inputs or long text headers containing directive words (e.g., "Ignore previous instructions") are preserved intact and fed directly into the model context.

ck