The Agent Skills Directory

[DATA_EXFILTRATION]: The instructions in references/codebase-understanding.md explicitly direct the agent to "Analyze dotenv files and configuration" and "Review development environment setup." This facilitates the exposure of sensitive data, such as API keys and credentials typically stored in .env files, to the model's context.
[COMMAND_EXECUTION]: The skill requires the agent to execute local shell commands to manage session state. Specifically, references/plan-organization.md instructs the agent to run node .claude/scripts/set-active-plan.cjs whenever a new plan is created.
[EXTERNAL_DOWNLOADS]: In references/research-phase.md, the skill utilizes the repomix tool to fetch and analyze content from remote repositories using the --remote flag with user-provided GitHub URLs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its heavy reliance on external, potentially untrusted data during the planning process.
Ingestion points: The agent ingests data from remote GitHub repositories (via repomix) and reports from subagents like researcher and scout as defined in references/research-phase.md and references/codebase-understanding.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate external reports or remote repository content from the agent's core instructions, making it susceptible to instruction overrides embedded in those sources.
Capability inventory: The skill has the capability to read/write files, execute local Node.js scripts, and spawn additional subagents based on its analysis.
Sanitization: The skill lacks any verification or sanitization steps for the data retrieved from external repositories before it is used to generate implementation plans.

planning