The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill executes a shell command at load time using the ! syntax to resolve configuration parameters.
Evidence: !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys review_mode,automation,workflow,docs.density,story_granularity,system_overrides in SKILL.md.
This is a project-specific tool used for environment configuration and does not interact with sensitive system files or network resources.
[COMMAND_EXECUTION]: The skill is authorized to execute a specific bash script for configuration management.
Evidence: The allowed-tools frontmatter restricts Bash to the yaml-helper.sh script located relative to the skill directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple design and architecture files which could potentially contain malicious instructions.
Ingestion points: The skill reads design/gdd/[filename].md, docs/architecture/[adr-file].md, docs/architecture/control-manifest.md, and docs/architecture/tr-registry.yaml as part of Step 2.
Boundary markers: The skill utilizes structured parsing, including Grep with context and Read with specific byte offsets and limits, which provides some structural isolation. However, it lacks explicit safety delimiters to warn the agent about embedded instructions in the ingested text.
Capability inventory: The skill has the ability to write new markdown files to the repository (Write) and spawn a secondary agent (Agent for qa-lead).
Sanitization: There is no evidence of content sanitization or filtering of the requirement text before it is interpolated into the generated story files.

create-stories