The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates data from external project files into its instructions for the agent.
Ingestion points: Reads status data and command parameters from .lev/pm/workstreams/*/trace/*.yaml and .lev/pm/proposals/*.yaml.
Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands when parsing these YAML files.
Capability inventory: The skill generates an 'Exec Menu' and 'Next Actions' section recommending lifecycle commands such as /exec, /propose, and /capture. A poisoned trace file could inject malicious arguments into these recommended actions.
Sanitization: No evidence of validation or sanitization of the YAML content before it is projected into the dashboard.
[DATA_EXFILTRATION]: The skill accesses files outside the active project directory, which could lead to unintended data exposure if the paths are manipulated.
Evidence: The skill explicitly reads from ~/.claude/skills/_shared/graph-footer.md to append content to its output.

sitrep