The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to create workspace directories using mkdir -p .idea-team/<slug>/, where the 'slug' is derived from user-provided ideas. If the derivation process does not strictly sanitize the input, this could be exploited for directory traversal or shell command injection.
[REMOTE_CODE_EXECUTION]: The instructions direct the agent to advise users to execute an external script (install.sh) from an unverified source (the spellbook repository) if certain components are missing. This promotes the execution of remote code without integrity checks.
[DYNAMIC_EXECUTION]: The skill dynamically loads instructions and persona definitions ('voices') by reading SKILL.md files from computed local paths such as ~/.claude/skills/ and ~/.agents/skills/. This mechanism relies on external files that could be tampered with or replaced to influence the agent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill has a notable attack surface for indirect prompt injection as it ingests untrusted user data (raw_idea) and passes it to multiple AI personas (Researcher, Devil's Advocate, Analogist) without explicit boundary markers or sanitization protocols.
Ingestion points: User-provided raw_idea processed in Section 4 and 5.
Boundary markers: The skill lacks explicit instructions for the sub-personas to ignore instructions embedded within the user's idea.
Capability inventory: File system access (mkdir, state.json, chat.md) and network operations (WebSearch).
Sanitization: There are no documented steps to sanitize the user's idea before it is evaluated by the persona team.

idea-team