The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from documentation files (.adoc) and source code (.java, .js, .ts) to perform quality reviews.
Ingestion points: File content is read and processed in scripts/_cmd_review.py and scripts/_cmd_analyze_tone.py during multiple workflows.
Boundary markers: The processing scripts attempt to skip AsciiDoc code blocks (----) and specific header characters to isolate text content.
Capability inventory: The skill possesses the ability to modify local files via the Edit tool based on analysis results and instructs the agent to apply "Deep Analysis" and "LLM judgment" to the ingested content.
Sanitization: No explicit sanitization or instruction-filtering is applied to the content before it is passed to the agent for evaluation, allowing specially crafted documentation text to potentially influence agent behavior during the review process.
[COMMAND_EXECUTION]: The skill executes internal Python scripts (docs.py) using the platform's standard .plan/execute-script.py mechanism to perform regex-based text analysis. These executions are scoped to the skill's primary purpose and do not accept arbitrary user-supplied command strings.
[DATA_EXPOSURE]: The skill accesses local documentation and source code files within the target project directory to perform its intended audit functions. While it reads file content, it does not exfiltrate data to external domains.

ref-documentation