The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent and its sub-agents to bypass the standard Collaboration Protocol which requires asking for user permission before performing file writes. It defines a 'bounded exception' to suppress these prompts, which reduces user oversight of automated file system changes.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the ! syntax to execute a shell command (bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config ...) at the time the skill is loaded. This execution happens before the AI agent begins processing the skill's instructions.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a local shell script (yaml-helper.sh) located in a parent directory. While the arguments are scoped in the frontmatter, the reliance on external shell scripts for configuration introduces a dependency on the local environment's integrity.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injections as it ingests and processes untrusted data from various project files.
Ingestion points: Reads sprint plans (production/sprints/*.md), bug reports (production/qa/bugs/*.md), story files, and smoke check reports (production/qa/smoke-*.md).
Boundary markers: The skill lacks explicit delimiters or 'ignore' instructions for the external content, relying instead on a 'distilled brief' prepared by the agent.
Capability inventory: The agent and its sub-agents have access to Write, Edit, Bash, and Agent tools, allowing for file modification and further sub-task execution.
Sanitization: There is no evidence of sanitization or validation of the content read from external project files before it is passed to the sub-agents.

team-qa