The Agent Skills Directory

[SAFE]: The skill implements a robust state management system using a local directory (_project/scrum-master/). This design ensures transparency and allows the team to inspect the persistent context stored by the agent.
[SAFE]: The initialization script (scripts/init-scrum.sh) performs standard file and directory operations within the project scope. It does not request elevated privileges (sudo), access sensitive system paths (e.g., ~/.ssh), or establish persistence in shell profiles.
[SAFE]: Security-conscious guidelines for external tool integration (Jira, Linear, etc.) are defined in references/kickoff.md. The skill is instructed to request user-mediated connections rather than asking for raw API tokens or sensitive credentials directly.
[SAFE]: Core operational rules in SKILL.md (Non-negotiables) provide strong guardrails against common AI failure modes. Specifically, Rule 4 ensures the agent never simulates human interactions and only provides drafts for user review, preventing unauthorized automated actions.
[SAFE]: The skill uses clear data lineage requirements (Rule 1), mandating that every metric must carry a source label. This minimizes the risk of the agent acting on unverifiable or injected data by exposing the origin of all information used in analysis.
[SAFE]: No malicious obfuscation, command injection patterns, or unauthorized network exfiltration attempts were found in the instructions, documentation, or scripts.

scrum-master