The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates and executes a shell command mkdir -p docs/plans/YYYY-MM-DD-<type>-<name> in Phase 7. The components <type> and <name> are derived from user-provided feature descriptions. If the agent does not strictly enforce the 'kebab-name' convention or fails to sanitize the input, a malicious user could provide input containing shell metacharacters (such as ;, &, or |) to execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the <feature_description> tag.
Ingestion points: User input enters the skill via the <feature_description> block in SKILL.md using the $ARGUMENTS variable.
Boundary markers: The skill uses XML-style tags (<feature_description>) to delimit user input, but it lacks explicit instructions to the agent to ignore any commands or overrides contained within that input.
Capability inventory: The skill has the ability to perform repository research (repo-research-analyst), create directories via shell (mkdir), and write content to markdown files on the local filesystem.
Sanitization: No explicit sanitization, escaping, or validation logic is defined to ensure that the content written to brainstorm.md or used in shell commands is safe from injection attacks.

brainstorm