The Agent Skills Directory

[DATA_EXFILTRATION]: The skill hardcodes absolute file paths to a specific user's directory (C:\Users\ffrol\.claude\projects\C--development-github-gflow-cli\memory\). This constitutes local data exposure, revealing sensitive user environment details and system structure. Access to these 'memory' files allows for the harvesting of project-specific context and potentially sensitive history.
[COMMAND_EXECUTION]: The skill uses various shell commands (grep, tail, git log) and executes local Python scripts using uv run (e.g., scripts/ci/check_doc_links.py, scripts/ci/generate_website_docs.py). These capabilities allow for local code execution based on the repository's content and script state.
[INDIRECT_PROMPT_INJECTION]: The skill implements an 'LLM council audit' that ingests numerous project files to generate review verdicts, creating a significant attack surface.
Ingestion points: Processes README.md, llms.txt, AGENTS.md, and all files in the docs/ directory.
Boundary markers: No explicit delimiters or instructions are used to distinguish documentation content from agent instructions during the audit.
Capability inventory: The skill possesses the ability to execute shell commands and write to the filesystem.
Sanitization: There is no evidence of sanitization or validation of the documentation content before it is passed to the AI sub-agents.
[DYNAMIC_EXECUTION]: The skill instructions provide a fallback to create a Python script (scripts/ci/check_doc_links.py) if missing and then execute it. Runtime code generation and execution represent a high-risk capability that can be exploited if the source instructions are compromised.

doc-review