The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from untrusted external sources.
Ingestion points: The agent is instructed to read Jira tickets, Confluence pages, and source code files from the repository.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious embedded commands within the ingested data.
Capability inventory: The agent has the ability to write to and delete files within the ~/.claude/cooking/ directory using shell commands.
Sanitization: No sanitization or filtering of external content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on shell commands to manage its internal execution state.
Evidence: The termination logic and setup instructions involve executing mkdir, printf, and rm commands to manipulate marker files in the user's home directory (~/.claude/cooking/).
[EXTERNAL_DOWNLOADS]: The skill references external scripts that are not included in the provided skill package.
Evidence: SKILL.md identifies hooks/cooking/stop-hook.sh as a related component necessary for the looping functionality.

investigation-loop