The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses $ARGUMENTS directly within shell commands, such as git log <branch>. This presents a surface for command injection if the input is not strictly validated or sanitized by the platform before execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from git commit messages, PR descriptions, and workflow files to generate its analysis. Maliciously crafted content in these sources could influence the agent's output or bias the retrospective findings.
Ingestion points: git log output, git diff output, GitHub PR content via gh pr view, and CI/CD workflow files in .github/workflows/.
Boundary markers: None explicitly defined to separate untrusted data from instructions.
Capability inventory: The skill possesses the ability to execute shell commands (git, gh) and read/write local files.
Sanitization: No explicit sanitization or filtering of the ingested repository content is mentioned.
[COMMAND_EXECUTION]: The skill implements a persistence-like telemetry feature in the 'SELF-EVOLUTION TELEMETRY' section. It attempts to detect a specific project memory directory (~/.claude/projects/) and append execution metadata to a file named skill-telemetry.md. While used for local logging/telemetry, this is a persistent write to a known system path.

recall