The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation mentions the syntax !command as a 'full check pattern' for director gates in .claude/docs/director-gates.md. While the skill itself does not invoke dangerous shell commands in its markdown, it references a framework where dynamic context injection is a standard feature. Analysis of the skill instructions shows that these commands are intended for status checks (e.g., git status) and project-specific tooling within a development workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it reads external, potentially untrusted documentation and configuration files (docs/engine-reference/, design/gdd/, docs/registry/architecture.yaml) and interpolates their content into prompts for the agent or sub-agents (Engine Specialists, Technical Director).
Ingestion points: docs/engine-reference/[engine]/VERSION.md, docs/engine-reference/[engine]/modules/[domain].md, design/gdd/*.md, docs/registry/architecture.yaml.
Boundary markers: The skill uses clear visual formatting for generated ADRs and assumptions, but does not explicitly use structural delimiters (like XML tags) to wrap all external data during the inference step.
Capability inventory: The skill has Read, Write, Glob, Grep, and Task capabilities, allowing it to modify the file system and spawn sub-agents based on the processed data.
Sanitization: There is no evidence of automated sanitization (like escaping or filtering) for the content read from external markdown/YAML files before it is processed by the LLM.

architecture-decision