The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project documentation files which could contain malicious instructions designed to influence the agent's behavior during the impact analysis phase.
Ingestion points: Reads content from design/gdd/, docs/architecture/, and design/registry/entities.yaml (SKILL.md, Phase 2, 4, 5).
Boundary markers: Absent; there are no explicit delimiters or instructions to ignore embedded commands within the analyzed documents.
Capability inventory: The agent has Write and Edit permissions, and can execute Bash scripts to replace file sections (Phase 7) or create new report files (Phase 9).
Sanitization: Absent; the content extracted from external documents is processed and quoted directly without validation or filtering.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command syntax to execute yaml-helper.sh at load time. This is used for environment configuration and resolving project-specific settings. While this occurs automatically upon skill activation, the command is hardcoded to a local hook script and does not incorporate unvalidated user arguments.
[COMMAND_EXECUTION]: The skill relies on several local bash scripts (adr-status.sh, md-section.sh, yaml-helper.sh) and standard git commands (git diff, git log) to perform its functions. These operations are essential for tracking document changes and managing the architecture traceability matrix within the repository.

propagate-design-change