The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's codebase, which could lead to indirect prompt injection if the processed content contains malicious instructions.
Ingestion points: The skill reads CLAUDE.md, milestone files in production/milestones/, and scans the entire codebase for TODO, FIXME, and HACK comments in references/claude-skill.md (Phases 2 and 3).
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded commands within the scanned code comments or project documentation.
Capability inventory: The skill uses the Write tool to generate a markdown checklist in the production/releases/ directory. It also uses Read, Glob, and Grep to perform its analysis.
Sanitization: There is no mention of sanitizing or escaping the content found in codebase comments before interpolating them into the final markdown checklist.

release-checklist