The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as git log, git branch, and grep to gather internal project status signals. These operations are limited to read-only information gathering within the specified project root.
[DATA_EXFILTRATION]: The skill integrates with Discord via a webhook for status notifications. The instructions explicitly mandate that sensitive information, such as the webhook URL and other tokens, must be retrieved from secure memory or configuration and never hardcoded or stored in the skill's persistent journal files.
[PROMPT_INJECTION]: The skill processes user-supplied engineering goals which are interpolated into a decomposition workflow. While this presents an indirect injection surface, the risk is mitigated by explicit manual review checkpoints for infrastructure changes and a verification step where the user/CEO must sign off on production deployments.
Ingestion points: User-provided goal and steer inputs in SKILL.md.
Boundary markers: Absent; inputs are interpolated into workflow arguments.
Capability inventory: Invokes the feature-factory skill, performs local file writes to the cto/ directory, and executes local git commands.
Sanitization: Relies on manual human review ('surface it for review') and the 'dry-run' parameter for plan validation before execution.
[CREDENTIALS_UNSAFE]: The skill documentation includes a specific guardrule preventing the agent from writing secrets or credentials to the project's architecture or journal logs, ensuring sensitive data remains in the execution environment's memory only.
[EXTERNAL_DOWNLOADS]: All external logic resides in local files, specifically the feature-factory skill and the .claude/workflows/cto-decompose.js script. The skill does not download or execute code from untrusted remote sources.