The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from external files within the project repository that could contain malicious instructions.
Ingestion points: The agent reads content from docs/wiki/, AGENTS.md, CLAUDE.md, contribution guides, and docs/backlog/ (SKILL.md).
Boundary markers: There are no specific delimiters or instructions to ignore embedded commands specified for the ingested content.
Capability inventory: The agent is authorized to execute shell commands (node scripts/validate-project.mjs) and perform Git operations (git diff, git commit) based on its findings (SKILL.md).
Sanitization: No sanitization or validation of the text content from ingested files is mentioned before it is processed or used in Git commits.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a local script node scripts/validate-project.mjs to verify the project state before making any modifications. While this is a standard development practice, it involves executing code present in the project workspace (SKILL.md).

wiki