The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The agent-stop-notification.sh script in references/real-world-examples.md extracts fields from .claude/multi-agent-swarm.local.md and uses them in a tmux send-keys command. Since the keys are sent to a target session, an attacker who can modify the settings file can inject arbitrary shell commands that will be executed by the shell in the coordinator's tmux session.
PROMPT_INJECTION (LOW): The ralph-loop pattern facilitates indirect prompt injection by using file content as agent instructions.
Ingestion points: .claude/ralph-loop.local.md body.
Boundary markers: Absent. The hooks/stop-hook.sh script extracts the entire markdown body as the reason for the agent's next action.
Capability inventory: Influences agent state via jq output.
Sanitization: Absent.
DATA_EXFILTRATION (SAFE): The example hook read-settings-hook.sh includes preventative checks for path traversal and sensitive file access.

plugin-settings