The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides explicit logic for locating and reading configuration files that may contain sensitive settings or environment-specific overrides.
Evidence: Step 1 directs the agent to resolve configuration by reading settings.json from CLAUDE_CONFIG_DIR or ~/.claude/, and to use project-specific overrides from .claude/settings.json and .claude/settings.local.json.
Security Concern: Files like settings.local.json are standard locations for local-only configurations that often include sensitive tokens, API keys, or environment secrets that should be handled with caution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external software development artifacts, creating a vulnerability surface where malicious instructions in those artifacts could influence the agent's behavior.
Ingestion points: Step 4 instructs the agent to include content from "affected files, specs, issues, PRs, or notes" when drafting the decision record.
Boundary markers: There are no instructions providing delimiters or "ignore embedded instructions" warnings for the external data being processed.
Capability inventory: The skill possesses the capability to read local files and environment variables (Step 1) and write persistent notes to a memory system (Step 3).
Sanitization: The instructions lack requirements for sanitizing, escaping, or validating the content retrieved from external sources before it is interpolated into the final note.

bm-decide