The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses a 'Brief Intake' (Step 0.1) which is a free-text input field that is subsequently passed as the master instruction set to all 15 agents in the chain. This represents a significant attack surface for indirect prompt injection.
[DATA_EXFILTRATION]: The orchestrator reads sensitive business data from ~/.claude/discovery-profile.md and connects to internal systems like CRM and product analytics. It specifically allows users to provide an arbitrary 'Destination' URL (Step 0.2 and 0.3) where the final discovery report, which incorporates findings from these sensitive sources, is published.
[COMMAND_EXECUTION]: The skill facilitates the execution of various MCP (Model Context Protocol) tools to interact with corporate infrastructure, including wikis, Notion, and databases. While this is the intended functionality, it grants the agent broad access to internal environments.
[DATA_EXFILTRATION]: In Category 8 (Indirect Prompt Injection) analysis: 1. Ingestion points: The Brief Intake (untrusted user input) in SKILL.md Step 0.1. 2. Boundary markers: None identified; instructions are passed directly to sub-agents. 3. Capability inventory: File read/write to ~/.claude/, WebFetch for external sites, and multiple MCP tools for internal data systems. 4. Sanitization: None; input is structured but not sanitized for instruction-like patterns.

product-discovery