The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the project environment, including runtime logs, console outputs, and configuration files. This creates a surface for indirect prompt injection where malicious instructions embedded in logs or project data could influence the agent's behavior.
Ingestion points: Runtime log streams (stdout/stderr), browser console levels, page errors, project configuration files, and visual capture manifests.
Boundary markers: The skill uses strict protocol guides and instructions to separate observed data from judgments, though no explicit multi-modal boundary markers are defined for raw log data.
Capability inventory: Shell command execution (Step 3, 5, 6), local script execution via Node.js (Step 6), code modification through the $fix tool (Step 5), and subagent spawning (spawn_agent).
Sanitization: The instructions explicitly mandate the redaction of secrets from captured logs and actual responses.
[COMMAND_EXECUTION]: The skill executes shell commands to start services, run tests, and perform comparisons. It is instructed to derive these commands from local project files like package.json, Docker Compose files, and CI scripts. It also specifically executes a local helper script: node .claude/scripts/lib/experience-verification.cjs compare. While these are standard development tasks, they depend on the integrity of the local repository.
[DYNAMIC_EXECUTION]: The skill's workflow involves resolving the lifecycle and execution commands (e.g., localRun) at runtime based on repository evidence. This dynamic resolution of executable paths is a standard feature of the tool but represents a potential vector for executing unexpected logic if the environment is misconfigured or malicious.

experience-review