The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content (plans, drafts, ideas) by inlining it into prompts for the Claude Code CLI. This creates an indirect prompt injection surface.
Ingestion points: User content is inlined into the ## Topic Under Discussion and ## User's Goal and Constraints sections of the prompt in SKILL.md.
Boundary markers: The skill mandates the use of fresh random-suffix delimiters (e.g., <<<UNTRUSTED[suffix]) to wrap all untrusted content, along with explicit instructions telling the model to treat the content as data rather than directives.
Capability inventory: The skill invokes the claude CLI which has read access to the workspace and network access. These capabilities are restricted by mandatory --permission-mode plan and --disallowedTools flags.
Sanitization: While content is not escaped, the combination of random delimiters and strict role-based instructions serves as the primary mitigation.
[COMMAND_EXECUTION]: The skill executes the claude CLI and shell utilities to manage the discussion.
The claude command includes user-supplied overrides for --model and --effort. The skill implements strict validation (regex ^[A-Za-z0-9._-]+$ and specific allowlists) to prevent shell command injection via these parameters.
[DYNAMIC_EXECUTION]: The skill generates and executes a small Python script at runtime via a shell heredoc to parse the JSON response from the Claude CLI.
The script is static and used for extracting the session_id and result fields into temporary files. It does not incorporate untrusted input into its executable logic.
[EXTERNAL_DOWNLOADS]: The claude CLI requires network access to communicate with the Anthropic API to process prompts. This is the intended behavior of the official CLI tool.

claude-discuss