The Agent Skills Directory

[OBFUSCATION]: The file scripts/dev-workflow.cjs consists of minified and bundled JavaScript code. This distribution format obfuscates the logic and makes it impractical to perform a security audit of the script's behavior to ensure no malicious patterns are present.\n- [PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted content from the codebase and feature documentation, making it susceptible to indirect prompt injection.\n
Ingestion points: PRD markdown files, checkpoints, and git diff output located within or regarding the .dev/ feature directory.\n
Boundary markers: The skill explicitly uses XML-like delimiters (<prd-content>, <checkpoint-content>, and <diff>) to isolate untrusted data.\n
Capability inventory: The skill possesses Edit permissions (restricted to feature markdown files) and Bash execution capabilities for git, node, and shell scripts.\n
Sanitization: It relies on prompting instructions to the model to treat the fenced data as untrusted, which is a significant mitigation but not a absolute guarantee of safety.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool extensively to execute local shell scripts and a complex Node.js utility. While it includes a validation script (scripts/validate.sh), the broad reliance on shell-level execution for core logic increases the attack surface.

dev-review