The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax to execute a bash script (yaml-helper.sh) at load time. This allows for silent command execution before the user or agent processes the skill content. Evidence: !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation,workflow in SKILL.md.
[DYNAMIC_EXECUTION]: The skill executes a script from a path resolved at runtime using traversal (../../) to access a location outside the skill's own bundle. This behavior could be used to execute unintended local files if the directory structure is manipulated.
[COMMAND_EXECUTION]: The skill executes shell commands both at load time via dynamic context injection and during runtime by spawning secondary agents to process project files. The restricted tool pattern for Bash also employs wildcards (*), which allows passing arbitrary arguments to a script outside the skill's folder.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by reading untrusted content from the project's codebase and passing it to a spawned security-engineer agent.
Ingestion points: codebase source files, project.yaml, and project.local.yaml.
Boundary markers: Absent; the brief template does not use specific delimiters or instructions to ignore content within the interpolated results.
Capability inventory: The skill has the ability to read files, execute bash commands, and spawn agents.
Sanitization: Absent; content from the codebase is directly passed into the brief for the secondary agent.

security-audit