The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and aggregates content from project files such as sprint reports and milestone definitions, which introduces a surface for indirect prompt injection.
Ingestion points: Reads files from production/sprints/ and production/milestones/ using the Grep and Read tools.
Boundary markers: The skill employs structured extraction via Grep targeting specific headers and limited line ranges (-A 12), which restricts the context to expected data sections.
Capability inventory: The skill has Write access to the production/ directory and can spawn a sub-agent via the Agent tool. The Bash tool is restricted via the YAML frontmatter to a specific configuration helper script.
Sanitization: The extracted content is processed directly by the model without manual sanitization, though the use of specific grep patterns acts as a functional filter.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context execution to resolve configuration at load time.
Evidence: !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys review_mode,automation in SKILL.md.
Analysis: This command executes a local project script to retrieve configuration settings. It uses hardcoded keys, does not perform network operations, and does not access sensitive system paths (e.g., .ssh or .aws), qualifying as a benign use of the feature.

milestone-review