The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic context execution syntax to verify dependencies at load time.
Evidence: !test -d "${CLAUDE_SKILL_DIR}/../privacy-by-design-rails" && echo "${CLAUDE_SKILL_DIR}/../privacy-by-design-rails" || echo "NOT_FOUND"`` in SKILL.md.
Context: This command runs automatically when the skill is accessed to ensure the required sibling skill is present.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase data and has significant system capabilities, creating an attack surface where malicious code within a project being audited could attempt to influence the agent's behavior.
Ingestion points: The skill reads various application files including db/schema.rb, Gemfile.lock, models, controllers, mailers, and background jobs.
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts in the analyzed codebase are specified.
Capability inventory: The skill uses Bash to execute a scanner, Read/Glob/Grep for discovery, and Write to generate a report file.
Sanitization: There is no documented sanitization of the content read from the Rails application before it is processed by the AI.
[COMMAND_EXECUTION]: The skill executes a Ruby-based scanner script located in a sibling directory.
Evidence: ruby ${CLAUDE_SKILL_DIR}/../privacy-by-design-rails/scripts/scanner.rb --markets <markets> in SKILL.md.
Context: The command executes a vendor-provided script (codeminer42) to establish a baseline for the privacy assessment.

privacy-assessment-rails