The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes untrusted data from the codebase and project-specific context files, which could contain malicious instructions designed to influence the agent's research output or subsequent actions.
Ingestion points: Project codebase files (via the explore topic), ai-context/features/<domain>.md, ai-context/architecture.md, and memory observations retrieved via mem_search in SKILL.md.
Boundary markers: Absent; the instructions do not specify delimiters or instructions to ignore embedded commands within the analyzed content.
Capability inventory: Write (disk persistence for artifacts) and mem_save (memory persistence) as defined in the execution wiring.
Sanitization: Absent; no escaping, filtering, or validation of ingested content is mentioned before processing.
[METADATA_POISONING]: The skill's metadata contains a contradiction regarding its functional capabilities, which may mislead users or automated systems regarding its permissions.
Evidence: The description field in the YAML frontmatter states "Pure research, no writes," while the Claude execution wiring section explicitly directs the agent to perform file writes using the Write tool to docs/sdd/{change-name}/explore.md.

sdd-explore