The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): Vulnerable to Indirect Prompt Injection via repository context files.
Ingestion points: The skill reads CLAUDE.md, agents.md, and README.md (Step 2).
Boundary markers: Absent. The skill parses sections like ## Project Actions and ## Roadmap without any sanitization or isolation markers (Steps 5, 6).
Capability inventory: The skill can execute shell commands (unison, git) and perform file writes to CLAUDE.md (Guardrails Check 1, 2).
Sanitization: Absent. The agent is instructed to directly parse and report content from these files, which may contain malicious instructions designed to hijack the agent's session.
[COMMAND_EXECUTION] (HIGH): Executes potentially dangerous system commands.
Evidence: Step 1 runs unison folders -batch -terse. Step 4b runs a complex sequence of git fetch, comm, grep, and sed using process substitution.
Risk: The unison command relies on a local profile named 'folders'. If an attacker can influence the environment or the profile configuration, they could trigger arbitrary file synchronization to a remote machine. The complex shell pipes in Step 4b could be vulnerable to command injection if branch names contain malicious characters and are not properly handled by the shell environment.
[DATA_EXFILTRATION] (MEDIUM): Potential for data exfiltration via synchronization tools.
Risk: While the skill aims to orient the user, its use of unison and git fetch --prune involves network operations. In a compromised repository context, these could be leveraged to push local project files or metadata to an unauthorized remote server.

start-session