The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to perform git commit operations within the resolved target repository to persist updates to the domain glossary and architectural decisions.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from various external sources to inform its documentation tasks. An attacker could potentially embed malicious instructions in codebase files, issue descriptions, or PR bodies to influence the agent's behavior during the modeling process.
Ingestion points: Codebase files, PR/Issue descriptions, plan documents, and wayfinder maps (all referenced in SKILL.md).
Boundary markers: The instructions do not specify any delimiters or safety warnings when reading these external sources.
Capability inventory: The skill has the ability to write to the filesystem (CONTEXT.md, docs/adr/*.md) and execute shell commands (git commit).
Sanitization: No sanitization or filtering of external content is described before interpolation or processing.
[DATA_EXPOSURE]: The skill resolves target repository locations by accessing local file paths, including ~/dev/code/<repo> and the registry file .agents/afk-pipeline/REGISTRY.md. While these are sensitive directory structures, the access is used exclusively to determine the working context for development tasks triggered by explicit user or artifact signals.

domain-modeling