The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from KNOWLEDGE.jsonl files and session history. This data is then passed to a specialist agent (bc-rules-organizer) for processing without explicit boundary markers or sanitization instructions in the delegation prompt to prevent the agent from obeying instructions embedded in the source data.\n- [DATA_EXPOSURE]: The scripts/rules.sh script includes a read mode that executes head -100 "$path". There are no path restrictions implemented in the script, meaning an agent could be coerced into reading sensitive files outside the project boundary if manipulated by an attacker.\n- [COMMAND_EXECUTION]: In review mode, the skill attempts to spawn a specialist reviewer agent from the project's own .claude/agents/ directory. This creates a risk where a malicious repository could define an agent that performs unauthorized actions when the user invokes the rules review command.\n- [COMMAND_EXECUTION]: The rules.sh script uses sed to inject values into templates. While there are internal notes about avoiding delimiter characters, the values for prefix and paths are derived from user input, which could potentially lead to template injection or file corruption if not strictly validated by the calling agent before script execution.

rules