The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use exec() for shell operations such as cat, grep, and ls. These commands are used to read and navigate the project's documentation. There is a potential risk of command injection if the agent dynamically builds these commands using strings extracted from document metadata, such as parent_proposal or supersedes fields, without sanitization.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted data from external markdown files. Ingestion points: The skill reads files using exec("cat ...") for proposals, specs, and decisions, and uses grep and search to find related documentation. Boundary markers: There are no explicit instructions for the agent to use protective delimiters or to ignore instructions that might be embedded within the artifacts being reviewed. Capability inventory: The agent is granted access to tools including exec, write, edit, and search within the scope of the project files. Sanitization: The instructions do not define any sanitization or validation logic for the content read from the markdown files before it is processed by the agent.

review-a-design