The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a self-referential string "Verdict: COMPLETE — next steps identified." at the end of Step 7, which mimics security analysis output and could be used to influence automated assessment tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project environment to determine its recommendations.
Ingestion points: Reads content from production/session-state/active.md, design/gdd/*.md, production/sprint-status.yaml, and the user-supplied argument-hint.
Boundary markers: Uses  markers to identify blocks in active.md, but these do not prevent malicious instructions within those blocks from influencing the agent's logic.
Capability inventory: The skill has access to bash for executing specific project scripts (artifact-check.sh, story-status.sh, yaml-helper.sh) and can run git log.
Sanitization: There is no evidence of sanitization or escaping of the content read from files before it is interpolated into the agent's decision-making process.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic execution at load time through shell command placeholders.
Evidence: !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys project.stage,workflow in SKILL.md.
Evidence: !bash "${CLAUDE_SKILL_DIR}/../../scripts/story-status.sh" in SKILL.md.
Context: These commands are limited to local scripts defined within the skill's infrastructure and are used to populate the skill's context with project metadata.

next-step