The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted PRD and checkpoint markdown files from the .dev/ directory to compare design intent with implementation.
Ingestion points: Step 3 reads $FEATURE_DIR/00-master-plan.md, $FEATURE_DIR/NN-sub-prd-*.md, and $FEATURE_DIR/checkpoint.md into the agent context.
Boundary markers: The skill uses XML-like tags (<prd-content>, <checkpoint-content>, and <diff>) to separate untrusted data from instructions.
Capability inventory: The skill possesses Read and Edit tools (scoped to markdown files) and spawns a feature-reporter subagent with codebase exploration tools (LS, Grep, Glob, Bash).
Sanitization: Instructions explicitly warn the model to treat the ingested content as data to be analyzed rather than instructions to be followed, and doc write-backs require explicit user confirmation.
[OBFUSCATION]: The file scripts/dev-workflow.cjs is a minified and bundled JavaScript file.
Evidence: The script is a minified bundle of various libraries (such as js-yaml, gray-matter, and micromatch) and custom workflow logic.
Analysis: The script appears to be a legitimate build artifact from the vendor. It includes specific security measures, such as explicitly disabling the dangerous js/function type in the bundled YAML parser.
[COMMAND_EXECUTION]: The skill executes several local scripts and a Node.js CLI to perform discovery, validation, and state management.
Evidence: SKILL.md invokes scripts/discover.sh, scripts/validate.sh, scripts/git-state.sh, and scripts/dev-workflow.cjs using bash and node.
Context: These executions are restricted to skill-local assets and standard developer tools like git and find. The skill includes path traversal validation in scripts/validate.sh.

dev-review