The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node to extract a dirHash from stelow.json, which is then used to construct the $SPEC file path variable. This variable is used without quotes in the shell command ls $SPEC. If an attacker provides a stelow.json file with a dirHash containing shell metacharacters (e.g., ;, backticks, or $(...)), it could lead to arbitrary command execution when the path is resolved.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes user-supplied spec-product.md files, which could contain malicious instructions designed to manipulate the analysis outcome or bypass intended workflow constraints.
Ingestion points: Reads spec-product.md and stelow.json from the local project directory.
Boundary markers: The instructions do not implement explicit boundary markers or system-level instructions to ignore embedded commands within the analyzed specifications.
Capability inventory: The skill can execute shell commands, read and write files, and interact with the user via the ask_user_question tool.
Sanitization: No sanitization is performed on the input specification data before it is processed by subagents.
[DYNAMIC_EXECUTION]: The skill employs node -e to execute a JavaScript snippet at runtime for the purpose of parsing the stelow.json configuration file and extracting workflow metadata.

stelow-workflow-plan-critique