The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and associated procedure documents describe using rm -rf to delete directories, specifically the .git directory of the framework template. While the skill defines safeguards—such as checking project markers and verifying repository origin—recursive deletion remains a high-risk operation on the local file system.
[REMOTE_CODE_EXECUTION]: The skill executes a local JavaScript file (cli.js) using node. The path to this script is determined dynamically and includes locations within the project's own directory structure (e.g., .architecture/.architecture/tools/cli.js), allowing the agent to execute code that could be supplied by a third-party template or a manually cloned repository.
[PRIVILEGE_ESCALATION]: The framework documentation explicitly instructs users to set the environment variable CLAUDE_ALLOW_PROTECTED=1 to bypass security hooks (PreToolUse) intended to protect sensitive configuration files like members.yml from unauthorized modification.
[INDIRECT_PROMPT_INJECTION]: The skill conducts a comprehensive analysis of the target project's codebase using Glob, Grep, and Read. The results are used to customize the framework's behavior and principles. This ingestion of untrusted project data creates an attack surface where malicious comments or code could influence the agent's future instructions.
Ingestion points: Target project files analyzed via Glob, Grep, and Read (SKILL.md Step 2).
Boundary markers: No explicit boundary markers or warnings to ignore instructions within analyzed files are mentioned in the logic.
Capability inventory: The skill possesses extensive capabilities including Bash (git, npm, node, mkdir, cp, ls, test), Write, Edit, and Read across all scripts.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the target project before it is used to generate analysis documents or update configurations.

setup-architect