The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to use npx claude-flow, which fetches and executes the 'claude-flow' package from the public NPM registry. This is a well-known service for package distribution.
[REMOTE_CODE_EXECUTION]: The framework allows for the execution of remote code through the npx command and spawning specialized agents (e.g., coder, orchestrator) capable of performing autonomous tasks.
[COMMAND_EXECUTION]: The skill documentation includes examples of executing shell commands and MCP tools to manage agent lifecycles, perform batch file operations, and conduct web research.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates a complex workflow where user-supplied task descriptions are processed by multiple autonomous agents with high-privilege capabilities.
Ingestion points: Untrusted data enters the context through task_description arguments in MCP tool calls (e.g., mcp__claude-flow__sparc_mode) and CLI commands in SKILL.md.
Boundary markers: Absent. The documentation examples show direct interpolation of task descriptions into agent instructions without delimiters or specific ignore-instructions guidance.
Capability inventory: The skill defines modes with significant capabilities, including autonomous code generation and editing (coder), web fetching and research (researcher), and multi-agent coordination (orchestrator) as detailed in SKILL.md.
Sanitization: None described. There is no evidence of input validation, filtering, or escaping for the strings processed by the agents.

sparc-methodology