The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection and potential path manipulation because it interpolates user-supplied arguments directly into file paths and document headers without sanitization.
Ingestion points: The $ARGUMENTS variable (project name) and the content of projects/<project>/gtm-context.md (read via the Read tool).
Boundary markers: None are used when reading or writing the GTM context files.
Capability inventory: The skill utilizes Read, Write, and Glob tools to manage project documentation.
Sanitization: There is no evidence of path sanitization or validation to prevent a user from providing a project name like ../../sensitive-dir, which could lead the agent to read or write files outside the intended directory.

gtm-onboarding