The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it reads and processes data from external sources that could be influenced by third parties.
Ingestion points: The skill reads PRD issue bodies, slice issue comments, and research archive entries from the filesystem and GitHub API using the gh tool in SKILL.md (Step 2 and 3).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading these external artifacts into the agent's context.
Capability inventory: The skill is capable of performing destructive actions such as deleting files (rm -f), closing GitHub issues (gh issue close), and modifying issue content (gh issue edit).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external artifacts before it is used to diagnose the project state.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to manage repository state and GitHub issues.
Evidence: It utilizes a bundled script references/sidecar.sh to perform git operations, manage local state, and interact with the GitHub CLI. It also explicitly instructs the agent to perform 'direct file deletion' during the cleanup process in SKILL.md (Step 4).
[DATA_EXFILTRATION]: The skill accesses and manages application state data in the user's home directory which could contain sensitive project information.
Evidence: The skill and its helper script references/sidecar.sh interact with ~/.claude/sidecars and ~/.claude/research. While these are designated locations for internal state storage, the ability to read and delete files in these locations is a significant permission set that could be exploited if the agent were compromised.

correct-course