The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill integrates external data from the web to research similar projects and competitors during the discovery phase.
Ingestion points: External content is brought into the agent context via WebSearch and WebFetch tools as described in workflows/01-discovery.md (Bloc D).
Boundary markers: There are no explicit instructions or delimiters defined to isolate or treat the fetched web content as untrusted data.
Capability inventory: The skill has Write permissions to the filesystem (to create documents in docs/projet/) and the ability to execute shell scripts.
Sanitization: No sanitization or filtering logic is provided for the data retrieved from external URLs before it is processed by the agent.
[COMMAND_EXECUTION]: During the initialization step, the skill executes a local shell script scripts/check-tools.sh to verify the environment.
The script probes the local filesystem for specific agent skill installations (e.g., in ~/.claude/skills/, ~/.config/opencode/skills/) and checks for the presence of CLI tools like git, node, and agent-browser.
While the script itself is a benign utility for environment validation, the execution of shell commands is a capability that should be monitored.

project-definer