The Agent Skills Directory

[SAFE]: The skill follows a well-defined, lightweight workflow for generating design specifications. It operates by reading local codebase context and writing the resulting document to a specific directory (docs/plans/).
[COMMAND_EXECUTION]: The skill performs read-only operations such as scanning for project conventions, reading manifests, and checking recent commit history (last 10–20 commits). It does not execute arbitrary shell commands or perform high-risk system modifications.
[DATA_EXFILTRATION]: There is no evidence of network communication or data being sent to external endpoints. The skill's operations are confined to the local filesystem.
[PROMPT_INJECTION]: The instructions include a specific "smart caveman" response style for the agent. This is a stylistic constraint and does not attempt to bypass safety filters or ignore system-level instructions.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads untrusted data from the local repository during the SCAN phase (Step 1), including README.md, CLAUDE.md, documentation files, and recent commit messages.
Boundary markers: The instructions do not define delimiters or specific "ignore embedded instructions" warnings when processing the content of these scanned files.
Capability inventory: The skill can write files to the local filesystem and interact with the user via questions. It is explicitly prohibited from performing git commit actions.
Sanitization: No validation or sanitization of the ingested repository content is performed before the agent synthesizes it into a design spec.
Risk: A malicious actor could place instructions in a commit message or a README file that might influence the agent's behavior during the design phase, although the impact is limited by the skill's restricted capabilities.

absolute-spec