The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources (plan/spec files and repository code diffs) and interpolates them into sub-agent prompts without robust sanitization or delimiters. Ingestion points include Step 3 (D.1) which loads plan/spec files from harness-native directories and Step 6 which reads full bodies of all changed files. The dispatch-prompt template uses simple Markdown headers which can be bypassed by malicious content.
[DATA_EXFILTRATION]: The skill accesses local agent platform configuration files, which is categorized as data exposure. References in safety-rules.md contain commands to read ~/.claude/settings.json and ~/.cursor/hooks.json using jq to verify the wiring of safety hooks. While used for security verification, these paths are outside the standard repository scope.
[COMMAND_EXECUTION]: The skill extensively uses local command-line tools to perform its primary functions, including executing git, gh (GitHub CLI), npm, vercel, and aws CLI tools, as well as running project-specific test and linting suites such as vitest, playwright, biome, tsc, mypy, and pyright.

ship