The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses a pointer mechanism to redirect the agent's core instructions to an external file located at a relative path (../../../.fullstack-forge/skills/forge-discover/SKILL.md). This path traversal reaches outside the expected skill directory, essentially hijacking the agent's instructional flow from an external source.
[COMMAND_EXECUTION]: The instructions explicitly command the agent to "Read the canonical playbook now and follow it exactly," which forces the dynamic loading and execution of instructions retrieved from the non-local path.
[INDIRECT_PROMPT_INJECTION]: By delegating the playbook to a file path within a potentially untrusted repository (the .fullstack-forge directory), the skill creates a surface for indirect injection. An attacker could place a malicious SKILL.md at that specific relative path within a repository to influence the agent's behavior during an audit.
Ingestion points: The agent is instructed to read the file located at ../../../.fullstack-forge/skills/forge-discover/SKILL.md (relative to the skill path).
Boundary markers: None present; the agent is told to "follow it exactly."
Capability inventory: The skill description implies the ability to perform repository audits and architecture mapping, which typically involves file system read access.
Sanitization: No validation or integrity checks are performed on the canonical playbook before the agent is instructed to follow it.

forge-discover