The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains directives to "Ignore Claude-specific mode-switch instructions when they appear" and establishes a "Strict execution contract" that requires the agent to prioritize the skill's protocol. While intended for environment compatibility and process reliability, these instructions function as overrides to standard agent behavioral constraints.
[COMMAND_EXECUTION]: The workflow involves the execution of local shell commands, specifically calling Python scripts located within the .claude/scripts/ directory (e.g., python .claude/scripts/code_graph ...). These scripts are used for analyzing codebase structure and tracing dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by systematically ingesting untrusted data from the repository codebase, external documentation, and research reports.
Ingestion points: Reads project configuration files (docs/project-config.json), explores source code (via $scout and grep), and processes various documentation and analysis artifacts.
Boundary markers: The instructions do not specify the use of delimiters or clear separation between the agent's instructions and the untrusted content being analyzed.
Capability inventory: The skill has access to significant capabilities, including the ability to spawn subagents (spawn_agent), execute local shell commands, and modify repository files.
Sanitization: There is no mention of sanitizing or validating the content retrieved from the codebase or project documentation before it is processed by the agent.

feature-implement