The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to "Analyze the project autonomously" and "Do NOT ask the user questions." This instruction, while intended for automation, increases the risk of the agent following malicious instructions embedded in the source project's files without human intervention.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface:
Ingestion points: The skill reads CLAUDE.md, memory/MEMORY.md, and various manifest files (package.json, pyproject.toml, etc.) which can contain attacker-controlled content if the project being analyzed is untrusted.
Boundary markers: The instructions do not define boundary markers or delimiters when processing the content of these files to distinguish between data and instructions.
Capability inventory: The skill has capabilities to read/write files and execute shell commands (git).
Sanitization: While the skill includes a "No secrets" validation phase to scrub sensitive data from the output, it does not sanitize the input for malicious instructions that could subvert the agent's logic during the analysis phase.
[COMMAND_EXECUTION]: The skill executes git log --format="%s" --reverse | head -80 to determine the project's build sequence. This is a legitimate functional requirement but involves running shell commands based on the state of the local repository.
[SAFE]: The skill demonstrates security best practices by including a dedicated validation phase (Phase 3) that scans all extracted files for secrets, absolute paths, and PII, replacing them with placeholders to prevent accidental data exposure in the resulting templates.

extract-template