The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to search for and extract sensitive credentials. In references/phase-3-develop.md under Deliverable 5: API Integration Specification, the instructions state: Look for API key configuration in .xcconfig or environment. Documenting secrets in plain-text markdown files within a project's docs/ directory is a high-risk practice that can lead to credential leakage if the files are committed to version control or shared.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted content from the local project, including source code, README files, and git history. This creates a vulnerability where malicious instructions embedded in these files could influence the agent's behavior during document generation.
Ingestion points: Project README, CLAUDE.md, source code, git history, and existing documentation files scanned via Glob and Read tools.
Capability inventory: Access to Write, Edit, Bash, and network tools (WebFetch, WebSearch).
Boundary markers: No specific delimiters or instructions to ignore embedded prompts are provided in the skill logic.
Sanitization: There is no evidence of filtering or sanitizing the data ingested from the codebase before it is processed by the agent.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to perform technical analysis of the project. It uses shell commands to analyze git logs for project velocity, search for specific file types (e.g., find . -name *.swift), and inventory project dependencies. While functional for its purpose, executing shell commands based on project structure requires oversight.

product-management-probok