The Agent Skills Directory

[COMMAND_EXECUTION]: The script 'scripts/change-archive.mjs' is vulnerable to command injection via the 'id' parameter. The variable is interpolated into a shell command for the 'zip' utility using double quotes, which do not prevent subshell execution (e.g., via backticks or dollar-parenthesis syntax) in many shell environments. An attacker who can influence the change ID could execute arbitrary commands.
[COMMAND_EXECUTION]: The 'getChangedFilesSince' function in 'scripts/lib/index.mjs' and the 'context-verify.mjs' script both use 'execSync' with unsanitized path variables interpolated into shell commands. This allows arbitrary command execution if a directory name or project path contains shell-active characters.
[PROMPT_INJECTION]: The skill ingests 'architecture.md' and 'decisions.md' to generate implementation tasks, creating a surface for indirect prompt injection where malicious instructions in project files could override agent behavior.
Ingestion points: 'architecture.md' and 'decisions.md' are loaded and processed during Phase 2 of the planning workflow.
Boundary markers: The skill does not define explicit delimiters or isolation instructions for the content of these files during interpolation.
Capability inventory: The skill has the ability to write files to the project directory and execute various helper scripts that perform filesystem and git operations.
Sanitization: The skill instructions include a directive to exclude fenced source-code blocks from the generated plan, providing a basic level of output filtering.

plan