The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the '!' prefix to execute a shell command at load time to resolve configuration. The command bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config ... uses an environment variable and path traversal to execute a script located outside the skill's directory.
[INDIRECT_PROMPT_INJECTION]: The skill accepts a [combat feature description] as its primary argument, which is then used to brief various subagents throughout the pipeline. This creates an attack surface where malicious instructions in the description could influence subagent behavior.
Ingestion points: The [combat feature description] argument in SKILL.md is the primary entry point for untrusted data.
Boundary markers: None identified; user input is distilled and passed directly into subagent prompts without explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has significant capabilities, including spawning subagents via the Agent tool, writing and editing files in the repository, and executing bash commands.
Sanitization: No evidence of input validation, escaping, or filtering of the user-provided description.
[COMMAND_EXECUTION]: The allowed-tools frontmatter and the dynamic context injection both reference a shell script (yaml-helper.sh) via path traversal (../../hooks/). This introduces a dependency on external code that is not contained within the skill package itself.

team-combat