The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (the ! syntax) to execute a Python script (load-constraints.py) automatically when the skill is loaded by the environment.
[COMMAND_EXECUTION]: The skill defines several pre-tool and post-tool execution hooks that trigger shell commands (uv run python3 ...) whenever specific tools such as Agent, Read, Grep, Write, and Bash are invoked.
[COMMAND_EXECUTION]: Instructions within the skill direct the agent to execute a bash script (check-all-ds.sh) which receives the current working directory as an input argument.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its logic depends on reading and interpreting the contents of external markdown files (SPEC.md, PLAN.md, LEARNINGS.md) and reports generated by other agents.
Ingestion points: Reads planning, specification, and outcome data from the .planning/ directory and ${CLAUDE_SKILL_DIR}/../../skills/ds-implement/references/ds-checks.md.
Boundary markers: There are no explicit prompt delimiters or instructions provided to the agent to treat the contents of these external files as untrusted data.
Capability inventory: The skill has access to shell execution (Bash, uv run) and the ability to dispatch subagents, which could be exploited if malicious instructions are injected into the analyzed files.
Sanitization: No sanitization or validation logic is present to filter the content of the ingested data before it is used to drive the verification flowchart and decision-making process.

ds-verify