The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic context injection pattern (!bash ...) in the SKILL.md file to execute a shell script (yaml-helper.sh) at load time. This script is used to resolve configuration keys such as review_mode and system_overrides. While the script path is relative to the skill directory, this mechanism executes code before user or agent interaction.
[COMMAND_EXECUTION]: The skill frequently invokes the Bash tool to execute local scripts and system utilities. Specifically:
Executes yaml-helper.sh to resolve configuration.
Executes review-receipts.sh to check for document freshness and compare hashes.
Executes gdd-structure-check.sh to determine the presence of document sections.
Executes grep to extract information from the registry and the target document. These commands are restricted in the frontmatter to specific scripts and patterns, which mitigates the risk of arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests and processes untrusted external data (design documents) while possessing significant capabilities.
Ingestion points: The skill reads the target design document ([path-to-design-doc]), design/registry/entities.yaml, and narrative files.
Boundary markers: The skill does not implement explicit delimiters or "ignore instructions" warnings when loading the content of these documents into the agent's context.
Capability inventory: The agent has the ability to execute specific shell scripts (including registry lookups and receipt generation), modify files via Write/Edit, and spawn multiple specialized sub-agents (Agent tool).
Sanitization: There is no evidence of sanitization or filtering applied to the content of the GDDs before they are processed by the main agent or passed to specialized sub-agents.

design-review