The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to interpolate user-provided $ARGUMENTS and <scope> variables directly into shell commands for the bd CLI (e.g., bd update <parent-id> --notes "... Scope: <arguments>."). This pattern can lead to command injection if the agent does not properly escape shell metacharacters provided in the user input.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the beads-cli Python package and references a remote repository on GitHub (github.com/steveyegge/beads) to enable issue tracking functionality.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface Detected.
Ingestion points: The agent is instructed to ingest data from the prototype, repository files, screenshots, routes, components, and documentation (SKILL.md).
Boundary markers: Absent. No delimiters or instructions are provided to the agent to distinguish between the skill's instructions and potentially malicious instructions embedded in the analyzed project data.
Capability inventory: The skill possesses file-write capabilities (writing to docs/hci/heuristic-evaluation.md) and shell command execution capabilities via the bd CLI (SKILL.md).
Sanitization: Absent. There are no mentions of validating or sanitizing the external content before it is processed by the agent or included in command-line arguments.

heuristic-eval-beads