The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several shell hooks and direct commands via uv run python3 to enforce constraints and perform checks. This includes a dynamic context injection pattern in SKILL.md (!uv run python3 ...) that executes at the moment the skill is loaded to populate the session with Typst constraints.
[DYNAMIC_EXECUTION]: In Step 4 (Verify), the skill dynamically locates and executes a widow detection script by searching the user's plugin cache directory (~/.claude/plugins/cache/tinymist-plugin/...). This relies on a computed path for execution, which is a technique that could be abused if the cache contents are manipulated.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it reads and processes multiple project-specific files including slides.typ, notes.typ, .planning/SOURCES.md, and .planning/HANDOFF.md.
Ingestion points: Multiple files are read into the agent's context, including presentation source code (slides.typ, notes.typ) and planning metadata.
Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore instructions embedded within the processed Typst or Markdown files.
Capability inventory: The agent has the ability to execute shell commands (Bash tool in Step 4) and write/edit files on the local system.
Sanitization: No evidence of sanitization, filtering, or validation of the content ingested from the presentation files before it is processed or used in decision-making.

workshop-revise