The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow discovery mechanism that searches for and loads SKILL.md files from multiple local paths, including project-specific hidden folders such as .claude/skills/ or .cursor/skills/ and the user's home directory. There is no evidence of sanitization or validation for these discovered skills, which could allow a malicious skill file placed in these locations to influence the agent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, such as goal statements, source URLs, and project files, which are used to generate the living goal.md and subsequent task files. This content is interpolated into agent prompts without explicit security boundaries or sanitization, potentially allowing embedded instructions in those files to bypass intended logic.
[COMMAND_EXECUTION]: The skill automates the use of the Git CLI for version control management, including commands like git init, git commit, and git status. While these are functional requirements for the skill's purpose, they involve direct interaction with the host system's shell.
[DYNAMIC_EXECUTION]: The skill dynamically generates subagent instructions and task definitions using templates in the assets/ directory. These generated instructions are then loaded and executed by the agent, representing a runtime generation of executable prompt logic.

delivering-goal