The Agent Skills Directory

[SAFE]: The skill provides automated reporting functionality based on user-defined metrics. Its operations are restricted to reading data and writing reports to a specific local directory (docs/pulse-reports/).
[COMMAND_EXECUTION]: The skill uses a dynamic context injection pattern in SKILL.md (!git rev-parse --show-toplevel) to resolve the repository root path at load time. This is a benign use of standard development tools for environment discovery.
[DATA_EXPOSURE]: Configuration is stored in .compound-engineering/config.local.yaml. The skill identifies this file as machine-local and gitignored, reducing the risk of accidental credential or configuration leakage to version control.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, which creates a potential surface for indirect prompt injection.
Ingestion points: External data is ingested from STRATEGY.md, local configuration, and results from analytics (PostHog, Mixpanel), tracing (Sentry, Datadog), and database queries.
Boundary markers: The skill lacks explicit boundary markers (e.g., XML tags or delimiters) to isolate untrusted data when interpolating results into the report template.
Capability inventory: The agent is granted Bash and Write capabilities, which could theoretically be abused if an attacker could influence the query results (e.g., error signatures).
Sanitization: There are no technical sanitization steps described beyond the policy instruction to exclude PII and PII-related identifiers.
[SAFE]: The skill includes a robust interview process in references/interview.md that explicitly refuses read-write database credentials and nudges users toward read-only access or standard MCP connections, demonstrating a security-conscious design.

ce-product-pulse