The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection. It reads data from user-controllable files such as define/problem-statement.md, define/hmw-questions.md, and persona profiles in the personas/ directory. This content is then interpolated into prompts for parallel Task agents (Personas) in Step 4b and Step 7. Since these agents have access to tools like Write and Bash, a malicious instruction embedded in the project files could potentially influence the agent's actions.
Ingestion points: Files in define/, discover/, and personas/ directories.
Boundary markers: The instructions lack explicit boundary markers or 'ignore' instructions for the interpolated content.
Capability inventory: The skill uses Bash, Write, Edit, and Skill (dispatch) tools.
Sanitization: No sanitization or escaping of the ingested file content is performed before interpolation into sub-agent prompts.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local management script ($CLAUDE_PLUGIN_ROOT/scripts/update-phase.sh) to track project state. This is a standard operational pattern for this skill architecture and does not appear to involve arbitrary command execution of untrusted input beyond the project directory path.

consulting-develop