The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because its core function relies on ingesting and processing content from multiple untrusted sources.
Ingestion points: Reads project materials including PROJECT.md, decisions/*.md, meetings/*.md, site-reports/*.md, TASKS.md, TIMELOG.md, and repository-level instructions like AGENTS.md, CLAUDE.md, .claude/, and .codex/ (SKILL.md, Step 3).
Boundary markers: The instructions do not specify any delimiters or safety warnings to prevent the agent from following instructions embedded within these external files.
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, WebSearch, and WebFetch (SKILL.md, YAML frontmatter).
Sanitization: No sanitization or validation of the content read from these project files is described.
[COMMAND_EXECUTION]: The skill explicitly allows the use of the Bash tool and directs the agent to execute specific internal scripts.
Evidence: The YAML frontmatter lists Bash as an allowed tool. Step 3 in SKILL.md instructs the agent to "Run the shared resolver and follow skills/project/references/context-resolution.md". While this appears to be internal logic, the combination of bash access and external data ingestion increases the risk of command injection.

workplan