The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and display changelog information from external sources during the update process. This creates a surface for indirect prompt injection, where malicious instructions embedded in a changelog could be interpreted and acted upon by the agent.
Ingestion points: External changelog content retrieved during the version check and update phase.
Boundary markers: The instructions do not define clear delimiters or specific guidance to the agent to treat the changelog content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill utilizes powerful tools including Bash, Write, and Edit, which could be exploited if an injection attack is successful.
Sanitization: No sanitization or validation of the retrieved changelog content is mentioned in the workflow.
[DYNAMIC_EXECUTION]: The skill employs an execution context that dynamically loads instructions from markdown files located at $HOME/.claude/get-shit-done/workflows/. This behavior separates the skill's logic from its main definition and relies on the integrity of the local filesystem, which is a dynamic loading pattern that increases the potential attack surface.

gsd-update