The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from ROADMAP.md or ROADMAP_*.md files to populate project configurations and rules.
Ingestion points: Project roadmap files (ROADMAP.md, ROADMAP_*.md).
Boundary markers: None identified; extracted content is mapped directly to INIT.md fields and the user review summary.
Capability inventory: File system access, shell command execution (git ls-files), and file creation (INIT.md).
Sanitization: No validation or sanitization of the extracted roadmap content is performed before processing.
[PROMPT_INJECTION]: The skill contains a social engineering pattern in the 'Codex Warning' section, instructing users to blindly click 'Trust' on a future security script. This attempt to influence user behavior to bypass platform security controls is a form of safety guideline circumvention.
[COMMAND_EXECUTION]: The skill executes a local shell command pipeline (git ls-files | sed ... | head -10) to perform stack inference. While the command is hardcoded, it relies on the output of git ls-files, which includes filenames that could be manipulated to influence the inference logic.

smart-init