The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill features a synchronization mechanism that fetches data from external "mirrors" (such as Notion database links) defined in project roadmap files. This creates a vulnerability where malicious instructions in the external data could influence the agent's behavior during the wrap-up process.
Ingestion points: Step 4 describes fetching rows from an external mirror specified in status-line trackers within repository files (e.g., ROADMAP.md).
Boundary markers: The instructions include conflict resolution ("show both values and ask, never silently pick"), but there are no explicit boundary markers or "ignore embedded instructions" warnings for the fetched external content.
Capability inventory: The skill can perform file writes (HANDOVER.md, learnings.md, session logs, CHANGELOG.md), execute shell commands (git), and perform network operations (git push).
Sanitization: There is no evidence of sanitization or strict schema validation for the data ingested from the external mirror before it is used to regenerate repository content.
[COMMAND_EXECUTION]: The skill routinely executes shell commands to manage version control and session state.
Evidence: The skill uses git status to check project state, git commit to save session logs and memory updates, and git push to synchronize changes to remote repositories (Steps 5, 6.5.4, and 12).
[DATA_EXFILTRATION]: The skill automates the transfer of local project data and session summaries to external locations.
Evidence: Step 4 involves "regenerating the mirror's rows" from local repository data to an external service like Notion. Step 12 performs automated git push operations for the project repo, the "brain" vault, and the ~/.claude configuration directory. If these external destinations (mirrors or remotes) are misconfigured or pointed to attacker-controlled endpoints via the roadmap files, sensitive project information could be exfiltrated.

wrap-up