The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Analyzed the skill's handling of untrusted task descriptions and advisor feedback.
Ingestion points: Input files like CARD.md and advice.json are parsed to build task plans.
Boundary markers: The skill uses explicit instructions to the agent to treat these inputs as data, effectively separating them from the agent's core instruction set.
Capability inventory: The Python logic is confined to file validation and structured data management; it does not perform network operations or spawn subshells with external input.
Sanitization: Rigorous schema validation and regex-based identifier checking prevent malformed or malicious data from affecting the script's logic.
[DATA_EXFILTRATION]: Evaluated local file access patterns for potential exposure risks.
Evidence: The skill saves 'recipes' to ~/.claude/decompose/recipes.json for persistence.
Safety Mechanism: The implementation includes a path_inside check to prevent the skill from overwriting its own plugin files, ensuring operations remain within safe boundaries.
[COMMAND_EXECUTION]: Reviewed the usage of Python scripts within the skill instructions.
Logic: The scripts are focused on task decomposition logic and do not contain patterns for executing arbitrary user-provided commands.

decompose