The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in Step 2 explicitly direct the agent to 'run the commands from the spec's ## Gates block yourself'. This allows the execution of arbitrary shell commands parsed directly from project documentation files (plans/*.md).
[INDIRECT_PROMPT_INJECTION]: The skill treats data within repository files as trusted instructions for action.
Ingestion points: The agent reads project-level README.md, CLAUDE.md, and every file in the plans/ directory.
Boundary markers: There are no boundary markers or instructions to ignore embedded malicious content within these files.
Capability inventory: The skill utilizes the Bash tool to execute commands and the Edit tool to modify files based on the output of those commands.
Sanitization: There is no evidence of sanitization or validation of the commands extracted from the ## Gates blocks before they are passed to the shell.
[DYNAMIC_EXECUTION]: The skill performs runtime assembly and execution of shell commands by parsing markdown content. This behavior creates a dynamic execution path where the logic being executed is determined by data files rather than the skill's own static code.

code-sync