The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill performs variable interpolation within a shell command: gsd-sdk query phase.add "${DESCRIPTION}" --raw. The DESCRIPTION variable is sourced directly from .planning/ROADMAP.md. An attacker who can influence the content of this file could inject shell metacharacters (e.g., backticks or semicolons) to achieve arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from multiple local files, creating a vulnerability surface for indirect instructions to influence agent behavior.
Ingestion points: The agent reads from .planning/ROADMAP.md, CONTEXT.md, and RESEARCH.md to display backlog items to the user.
Boundary markers: No delimiters or safety instructions are present to prevent the agent from obeying instructions embedded within these files.
Capability inventory: The skill possesses significant capabilities, including file system modification (mv), deletion (rm), and execution of the gsd-sdk tool.
Sanitization: The skill lacks any mechanism to escape or validate the content read from the file system before using it in prompts or commands.
[COMMAND_EXECUTION]: The skill instructions involve executing several powerful shell commands, including directory removals and moves, which are driven by inputs parsed from project files.

source-command-gsd-review-backlog