The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's workflow in SKILL.md (Step 6) directs the agent to run "smoke checks" for core commands found within audited files, such as dev, test, build, and lint. This behavior allows the execution of arbitrary shell commands defined in local project configuration files, which could be malicious.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and acts upon instructions found in untrusted AGENTS.md files and their variants.
Ingestion points: Reading AGENTS.md, CLAUDE.md, and CLAUDE.local.md as specified in SKILL.md.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the files being audited.
Capability inventory: Shell execution of project scripts and file system operations (mv, ln -s, find) as described in SKILL.md and references/quality-criteria.md.
Sanitization: Absent; the skill does not validate or sanitize commands before execution.
[DATA_EXFILTRATION]: The skill is instructed to access sensitive file paths, including the user's global configuration at ~/.claude/CLAUDE.md and project-level .env or secret information discussed in AGENTS.md (as noted in references/quality-criteria.md). While this is for auditing purposes, it exposes sensitive data to the agent's context.

agents-md