The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses a sensitive configuration path in the user's home directory: ~/.paseo/orchestration-preferences.json. While this appears to be a standard configuration file for the associated 'Paseo' toolset, accessing files within the user home directory is a behavior that contributes to data exposure risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its design of processing various external documentation files as instructions for its review process.
Ingestion points: The skill reads roadmap.md, items.yaml, and requirement/architecture documents referenced in file frontmatter, as well as external reviewer outputs.
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to treat the contents of these documents as untrusted data or to ignore embedded instructions.
Capability inventory: The agent has the ability to read and write files within the project structure and invoke MCP tools such as mcp__paseo__create_agent to spawn additional sub-agents.
Sanitization: The skill does not define any sanitization or validation logic for the content ingested from the roadmap or documentation files before processing them or passing them to sub-agents.
[COMMAND_EXECUTION]: The skill utilizes the mcp__paseo__create_agent tool to orchestrate sub-agents. This allows the skill to dynamically delegate execution to other agent contexts based on the content of the files it reads, which could be exploited if those files contain malicious instructions.

cs-roadmap-review