The Agent Skills Directory

[DATA_EXFILTRATION]: Hardcoded absolute filesystem paths referencing a specific user's home directory.
Evidence: @C:/Users/nicol/.codex/get-shit-done/workflows/execute-phase.md and @C:/Users/nicol/.codex/get-shit-done/references/ui-brand.md.
Impact: Exposes the local username ('nicol') and the host's directory structure. This is a privacy concern and indicates the skill is tailored for a specific environment.
[COMMAND_EXECUTION]: The skill dynamically executes logic from an external workflow file located on the local filesystem.
Evidence: The <process> section instructs the agent to execute execute-phase.md end-to-end.
Impact: The core execution logic is separated from the skill manifest, which can allow for changes to the agent's behavior that are not visible during static analysis of the skill itself.
[PROMPT_INJECTION]: Indirect prompt injection surface and deceptive metadata.
Ingestion points: The skill processes user-supplied arguments via {{GSD_ARGS}} and reads content from the external workflow file execute-phase.md.
Boundary markers: Absent. There are no delimiters or specific instructions to isolate untrusted data from arguments or external files.
Capability inventory: The skill can spawn subagents (spawn_agent) and manage agent lifecycles (wait, close_agent).
Sanitization: No sanitization or validation of the input arguments or workflow content is performed before processing.
Metadata Deception: The skill contains risk: safe in the frontmatter, which is a self-assigned safety claim that could mislead users about the skill's actual security posture.

gsd-execute-phase