The Agent Skills Directory

[Category 8: Indirect Prompt Injection] (SAFE): The documentation describes a mechanism where local configuration files in the .claude/ directory are used to provide instructions to the agent based on event triggers. This represents a potential vulnerability surface for indirect prompt injection if malicious rules are present in a project, but the documentation itself is safe and suggests using .gitignore to prevent rule sharing.
Ingestion points: Rules are read from .claude/hookify.*.local.md files.
Boundary markers: Not explicitly defined in the rule structure; rule messages are injected directly as context.
Capability inventory: Rules can trigger on bash command execution, file operations, and user prompt content.
Sanitization: None described for the markdown message body.
[Category 6: Persistence Mechanisms] (SAFE): The documentation explains how to create persistent rule files that influence the agent across different sessions within a project. This is the intended functionality of the framework.
[General Security] (SAFE): The skill contains no executable code, remote downloads, or obfuscation. It includes helpful security patterns such as monitoring for sudo, rm -rf, and .env file modifications.

writing-hookify-rules