The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to indirect prompt injection through workspace data.
Ingestion points: Agent instructions are derived from objectives and constraints defined in docs/goals/<slug>/goal.md and state.yaml (see SKILL.md).
Boundary markers: The system lacks explicit delimiters to separate user-provided task content from system instructions.
Capability inventory: The agent roles utilize tools such as Read, Grep, Glob, and Bash, with the Worker role having workspace write access (see references/claude-code.md).
Sanitization: The check-goal-state.mjs validation script checks for YAML structure but does not sanitize natural language objectives or constraints.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands for verification and validation.
Worker tasks in state.yaml contain a verify field with shell commands intended for execution by the agent to confirm task completion.
A local utility, scripts/check-goal-state.mjs, is provided to validate board integrity and is intended to be run by the user or agent.
[EXTERNAL_DOWNLOADS]: The documentation references well-known external tools and source repositories.
It suggests the use of pnpm for executing project-specific tests and verification commands.
It links to the original tolibear/goal-maker GitHub repository for credit and pattern reference. These references to well-known services do not escalate the security risk.

goal-maker