The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell tools such as mkdir and cp with the workspace_path variable, which is sourced directly from user input. This input is not validated or sanitized, creating a risk where an attacker could achieve arbitrary command execution by providing a path containing shell metacharacters like semicolons or backticks.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface (Category 8) by collecting untrusted data during the onboarding interview and interpolating it into its configuration and the shell environment.
Ingestion points: User-provided responses to the interview prompts in SKILL.md, specifically the workspace_path and modality fields.
Boundary markers: The skill uses a structured interview table to delimit the data collection process.
Capability inventory: Access to shell commands (mkdir, cp, gh), file system operations (Read, Write, Edit), and reading from platform configuration files like ~/.claude/CLAUDE.md.
Sanitization: The instructions do not specify any validation, escaping, or sanitization of the user-provided strings before they are used in shell commands or written to the config.json file.

onboard