The Agent Skills Directory

[SAFE]: The skill manages local project configuration files (project.yaml and project.local.yaml) and does not perform any network operations or external downloads.- [COMMAND_EXECUTION]: Shell execution is limited to specific local scripts (.claude/hooks/yaml-helper.sh and .claude/scripts/config-set.sh) and standard utilities (grep). These calls are parameterized and restricted by the allowed-tools configuration.- [INDIRECT_PROMPT_INJECTION]: While the skill ingests content from project files, it implements robust validation through enum validation (validate_enum_value), known-key checks, and schema validation. These serve as effective boundaries against accidental or malicious data processing.- [DATA_EXPOSURE]: The skill accesses project configuration files. This is consistent with its stated purpose of managing project settings and does not involve exfiltration to external domains.

project-settings