The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command to resolve the plugin's root directory path. Specifically, it provides a command snippet: PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-}"; [ -n "$PLUGIN_ROOT" ] && PLUGIN_ROOT="$(cd "$PLUGIN_ROOT" 2>/dev/null && pwd)"; echo "PLUGIN_ROOT=$PLUGIN_ROOT". While this is intended for environment configuration and path resolution, shell execution in instructions always requires review to ensure the command cannot be modified by external inputs.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a documentation generator that ingests data from external and potentially untrusted sources such as User Stories (US), Technical Tasks (TK), and repository source code.
Ingestion points: The skill reads input from user prompts, delegating skills (work-define, work-plan), and repository files (US, TK, WI, and code files).
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" markers to isolate this external data when it is interpolated into the agent's context for documentation generation.
Capability inventory: The skill possesses file-write capabilities (writing to docs/specs/technical-docs/), file-read capabilities, and the ability to execute shell commands for path resolution.
Sanitization: There are no explicit instructions to sanitize, escape, or filter the external content before processing, which could allow malicious instructions embedded in a User Story or code comment to influence the agent's behavior during the documentation process.

design-define