The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses user input ($ARGUMENTS) in the command mkdir -p .claude/skills/$ARGUMENTS. While the Bash tool is restricted to mkdir, this pattern is vulnerable to path traversal (e.g., ../../) if the input is not strictly validated, potentially allowing directory creation in unauthorized locations.\n- [COMMAND_EXECUTION]: The Write tool is used to create files at paths derived from user input (.claude/skills/$ARGUMENTS/SKILL.md). This allows for potential path traversal, which could lead to writing files outside the intended skill directory if the kebab-case naming convention is not enforced.

create-skill