The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script to perform a post-write validation of the generated artifact.
Evidence: In SKILL.md under the Post-Write Validation Gate section, the command is specified as: $PY <kb-start-scripts>/kb_type_validate.py validate {kb_root}/deliverables/{scope}-experiment-roadmap.md.
[DYNAMIC_EXECUTION]: The validation command uses shell variables and string interpolation ({kb_root}, {scope}) that are dynamically resolved from the repository's CLAUDE.md file and command-line flags. If these values contain malicious shell metacharacters, it could lead to arbitrary command execution.
Evidence: SKILL.md contains a Mode Resolution Procedure that parses the KB root path from CLAUDE.md. This path is then directly used in the shell command constructed for the validation gate.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various external and potentially untrusted sources, including client positioning context, spec files, and other knowledge base artifacts.
Ingestion points: The skill reads files from .claude/context/*.md and globbed silver artifacts in reference/cro-{scope}/. It also takes input from a --spec flag which can be a file path or inline text.
Boundary markers: While the skill provides instructions on maintaining 'Deliverable Purity' (e.g., not referencing system internals in the output), it does not employ robust delimiters or escaping mechanisms to prevent instructions within the input data from influencing the agent's behavior.
Capability inventory: The skill has capabilities for reading and writing files and executing local shell commands.
Sanitization: No explicit sanitization or content validation for the ingested data is defined in the execution pipeline.
Evidence: Described across Operating Modes, Read-side Mapping, and Phase 0: Spec Intake in SKILL.md and phases/detect.md.

hypothesis-generator