The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which is then interpolated into prompts for specialized sub-agents.
Ingestion points: The plan workflow (references/workflows/plan.md) fetches data via mcp__linear-server__get_issue, get_project, and get_initiative. The plan-task workflow (references/workflows/plan-task.md) reads codebase files and git log output.
Boundary markers: The instructions do not define clear delimiters or "ignore previous instructions" guards around the ingested external data.
Capability inventory: The skill and its sub-agents have the ability to write/edit local files, perform web research (WebSearch, WebFetch), and modify Linear entities (save_issue, save_project, save_milestone, save_initiative).
Sanitization: No explicit sanitization or filtering logic is present to process the external content before it is passed to LLM agents.
[PRIVILEGE_ESCALATION]: The allow workflow (references/workflows/allow.md) is designed to modify the platform's security configuration (settings.json) to bypass user prompts for specific commands.
The workflow updates the .permissions.allow array in both project-level and global (~/.claude/settings.json) configuration files.
It grants pre-approval for various shell commands (git, grep, sed) and Linear MCP tools.
[PERSISTENCE]: By modifying the global settings file, the skill ensures that its elevated permissions and command bypasses remain active across different projects and future sessions.
[COMMAND_EXECUTION]: The skill includes a Python script (scripts/cv_init_store.py) that executes shell commands to initialize the project environment.
The script uses subprocess.run to call git rev-parse and git -C to compute repository slugs and manage symlinks for the .codevoyant directory.

plan