The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts information from untrusted sources like CLAUDE.md, docs/prd.md, and dependency manifests (package.json, pyproject.toml) to populate a new docs/workflow.md file and update existing project files. This creates an attack surface where malicious content in these files could influence the agent's behavior or output.
Ingestion points: Reads from CLAUDE.md, docs/prd.md, package.json, pyproject.toml, Makefile, and various linter configuration files.
Boundary markers: The instructions do not define delimiters or warnings to ignore instructions embedded in the processed data.
Capability inventory: The skill has access to Bash for command execution and Write/Edit for file modification.
Sanitization: There is no evidence of sanitization or filtering of the extracted text before it is used in prompt interpolation or written to files.
[COMMAND_EXECUTION]: The skill executes shell commands via the Bash tool to create project directories (e.g., mkdir -p docs). While these specific commands are benign and necessary for setup, the use of Bash in conjunction with untrusted data ingestion provides a potential vector for command injection if not handled carefully by the underlying agent platform.

solo-setup