The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command syntax in the Preamble section of SKILL.md to execute a shell command: bash "$(dirname "${BASH_SOURCE[0]}")/../../check-update.sh". This script runs automatically when the skill is loaded to verify the version, which is a common but powerful capability that executes outside of the standard agent loop.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest free-text input from users and incorporate it into project documentation, creating a vulnerability surface for indirect prompt injection.
Ingestion points: User input is collected through several AskUserQuestion calls in SKILL.md during the registration of change requests, impact assessments, and decision recording.
Boundary markers: The instructions do not define clear delimiters or use system-level instructions to ignore potential commands embedded within the user's input before processing it.
Capability inventory: The skill is granted access to the Bash tool for shell execution and the Write tool for persistent file system changes, which could be targeted by a successful injection attack.
Sanitization: There are no explicit validation or filtering steps mentioned for the data gathered from the user before it is written to the docs/ directory or processed by sub-agents.

pm-change