The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax to execute a shell command automatically when the skill is loaded. Specifically, it runs bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation to determine the project's automation settings. While this is used for legitimate configuration purposes, load-time execution occurs before the AI or user can review the specific invocation, representing an elevated risk if the environment or the target script is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple project sources, which serves as a significant attack surface for indirect prompt injection.
Ingestion points: The skill reads and interprets content from git log output, docs/CHANGELOG.md, sprint retrospectives in production/sprints/, balance change documents in design/balance/, and tone/style guides such as design/community/tone-guide.md.
Boundary markers: The instructions do not define boundary markers or delimiters when interpolating these external data sources, nor do they include warnings for the agent to ignore instructions embedded within the ingested text.
Capability inventory: The skill is granted Read, Write, and Bash capabilities, which can be leveraged to perform file system modifications or system commands based on the content of the processed data.
Sanitization: There is no evidence of sanitization or filtering to prevent malicious natural language instructions (e.g., hidden in commit messages) from influencing the agent's behavior.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to gather git history and resolve configuration. Although the platform configuration in the frontmatter attempts to restrict these calls, the core logic requires the agent to execute shell commands to function, which allows the agent to interact with the project's version control system and local scripts based on its interpretation of the task.

patch-notes