The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It is designed to read and process untrusted local source files and remote GitHub issue content to generate engineering plans. Maliciously crafted content in these analyzed files could potentially override the agent's instructions or influence its output during the planning phase.\n
Ingestion points: Local source code files, CLAUDE.md, package.json, and GitHub issue metadata (titles and descriptions).\n
Boundary markers: Absent; the agent is instructed to trust and incorporate findings from these files without explicit delimitation or warnings against embedded instructions.\n
Capability inventory: Full file system read/write access and the ability to execute CLI tools like git and gh.\n
Sanitization: While the issue-derived folder names are slugified via regex, no sanitization or filtering is applied to the content of the analyzed files themselves.\n- [COMMAND_EXECUTION]: The skill uses shell commands to resolve environment context and fetch issue data.\n
Evidence: It executes git branch --show-current and gh issue view. Parameters passed to the gh tool are validated using a strict numeric regex (^[0-9]+$), mitigating direct command injection risks.\n- [DATA_EXFILTRATION]: The skill utilizes relative paths that attempt to access files outside of the project's root directory.\n
Evidence: SKILL.md contains a mandatory protocol step to read an 'intel dossier' from ../rick-intel/LOOKUP.md. This path traversal could allow access to data in parent or sibling directories if the execution environment is not strictly sandboxed.

rick-plan