The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a runtime context injection mechanism using Claude Code hooks (PreToolUse and PostToolUse). The scripts runtime/scripts/drift-context.sh and runtime/scripts/post-check.sh perform upward directory traversal to find specification files (CONCEPT.md, PIPELINE.md, SYNCS.md). The content of these files is extracted and injected into the agent's session as additionalContext. This creates an attack surface where malicious instructions embedded in a project's specification files could influence or override the agent's behavior during code edits.
Ingestion points: Specification files (CONCEPT.md, PIPELINE.md, SYNCS.md) are read by the hook scripts when the agent edits files in the project.
Boundary markers: The scripts use delimiters such as [filename ## section] and Declared boundaries: to separate injected content from the rest of the prompt.
Capability inventory: The skill possesses file system traversal and read capabilities, and triggers on file write/edit operations to perform its checks.
Sanitization: The scripts use sed to extract specific sections but do not perform sanitization or escaping of the text content within those sections before injection into the context.
[COMMAND_EXECUTION]: The skill relies on several bash scripts (session-start.sh, drift-context.sh, post-check.sh) to perform its primary functions. These scripts are executed via Claude Code's hook system and utilize standard system utilities such as find, grep, sed, awk, and jq for file system scanning and text processing.

concept-guardrails