The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a command /cs:founder-mode <question> which accepts arbitrary user-supplied text. This input is used to determine routing logic and is directly interpolated into downstream processes.
Ingestion points: The <question> argument in SKILL.md is the primary entry point for untrusted data.
Boundary markers: The provided documentation does not specify the use of delimiters or clear instructions to the agent to treat the <question> content as untrusted data, increasing the risk of the agent obeying instructions embedded within the question.
Capability inventory: The skill has the capability to write files to the local file system (specifically ~/.claude/briefs/) and invoke multiple other specialized agents (cs-cfo-advisor, cs-ceo-advisor, etc.), which could be abused if a malicious question influences the agent's logic.
Sanitization: There is no evidence of sanitization or validation performed on the user-supplied question before it is written to disk or passed to other agents.

founder-mode