The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to execute git rev-parse --show-toplevel to determine the project root. While functional, this involves direct interaction with the host shell.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user responses, summarizes or records them, and uses this content to determine the next steps in the questioning process. This creates a feedback loop where untrusted data influences agent behavior.
Ingestion points: User answers provided during the adaptive questioning session in SKILL.md.
Boundary markers: The skill relies on Markdown structures (headers and bold labels like **Answer:**) to separate user content from instructions.
Capability inventory: Read (file access), Write (file creation and appending), Bash (shell execution for path resolution), and AskUserQuestion (user interaction).
Sanitization: The instructions do not specify any validation or sanitization for user input before it is written to disk or processed by the agent.
[COMMAND_EXECUTION]: The skill constructs a filename using a user-provided session name (<name>.qa.md). Without strict sanitization of the input name, this pattern is susceptible to directory traversal attempts (e.g., providing a name like ../../etc/config) which could lead to unauthorized file writes outside the project root.

ask-question