The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external phase manifests while possessing command execution capabilities.
Ingestion points: Data enters the agent context through the phase manifests and reference files located in ~/.claude/gsd-core/ (read via the Read tool).
Boundary markers: The skill does not define clear delimiters or "ignore embedded instructions" warnings when processing the contents of these manifest files.
Capability inventory: The skill is authorized to use the Bash tool to execute git commands and the Read tool to access files (defined in SKILL.md).
Sanitization: No explicit sanitization or validation of the manifest content is described, although the skill's objective mentions a 'confirmation gate' to review actions before execution.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform destructive git operations (revert). This is the intended primary purpose of the skill to manage repository state.
[DATA_EXPOSURE]: Accesses internal configuration and workflow files within the ~/.claude/gsd-core/ directory. These are vendor-specific resources used to facilitate the rollback process and do not appear to contain sensitive user credentials.

gsd-undo