The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (project-init.sh, sync-portfolio.sh) located in the plugin's cache directory to initialize and synchronize project data.
[DYNAMIC_EXECUTION]: Script paths are resolved at runtime using shell substitution (e.g., $(ls -td "$HOME"/.claude/plugins/cache/... | head -1)). This mechanism is used to locate the plugin's own internal components across different environment configurations.
[PROMPT_INJECTION]: The skill processes user-provided markdown files (Lean Canvas or Business Model Canvas) and extracts content to create structured JSON entities. This represents an indirect prompt injection surface if the source files contain adversarial instructions.
Ingestion points: Reads external markdown files provided by the user during the bootstrap workflow.
Boundary markers: No specific delimiters or "ignore instructions" markers are used when parsing the user content.
Capability inventory: The skill utilizes Write, Edit, and Bash tools to modify the workspace based on the parsed data.
Sanitization: No explicit sanitization or structural validation of the input markdown content is performed before processing.

portfolio-canvas