The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the $ARGUMENTS variable and passes it directly to internal workflows for processing. This creates a vulnerability surface where a user could provide a crafted phase description intended to manipulate the agent's behavior when it uses sensitive tools like Bash or Write.
Ingestion points: SKILL.md (via $ARGUMENTS interpolation into workflow calls).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the user input as data rather than instructions.
Capability inventory: The skill utilizes the Bash and Write tools, which allow for significant system and file modifications.
Sanitization: There is no evidence of input validation or sanitization before the arguments are passed to the sub-workflows.
[DYNAMIC_EXECUTION]: The skill dynamically incorporates instruction sets from external Markdown files located at ~/.claude/gsd-core/workflows/. While these appear to be vendor-specific configuration files, the pattern of loading execution logic from external paths represents a dynamic loading mechanism that could be abused if the file system is compromised.

gsd-phase