The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to run git log. Specifically, in references/claude-skill.md, it directs the agent to "Adjust the --since date to match the sprint duration if known from the sprint plan." Constructing shell commands by interpolating values directly from repository files (which may be attacker-controlled in scenarios like malicious Pull Requests) without explicit sanitization or validation creates a risk of command injection.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by ingesting and processing data from various local sources.
Ingestion points: The skill reads sprint plans (production/sprints/), milestone definitions (production/milestones/), status files (production/sprint-status.yaml), and git logs.
Boundary markers: Absent. There are no instructions to use delimiters or protective wrappers when processing these inputs.
Capability inventory: The skill has access to Read, Glob, Grep, Write, Bash, and AskUserQuestion tools.
Sanitization: Absent. The instructions do not mandate any escaping or validation of the data extracted from the repository before it is used to generate reports or execute commands.

retrospective