The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/build_registry.js uses execSync to run a sub-process. The root argument is interpolated directly into the shell command string without proper escaping or sanitization, which could allow arbitrary command execution if a malicious path is provided as an argument. Similar patterns exist in scripts/scan_domains.sh where the $dir variable is interpolated into node -e calls.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It parses descriptions from untrusted files like README.md and package.json and writes them into CLAUDE.md.
Ingestion points: Scans README.md, project.json, and package.json files within the project directory.
Boundary markers: Uses  markers in CLAUDE.md, but these do not prevent the agent from following instructions contained within the table.
Capability inventory: The skill possesses write access to CLAUDE.md, a file often containing system-level instructions for AI agents.
Sanitization: Only basic whitespace trimming and markdown bold-character removal are performed on the extracted descriptions.

domain-init