The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes and executes a local Python script scripts/check_walkthrough.py which uses subprocess.run to call git show and git check-ignore. While it uses argument lists which mitigate shell injection, the commands are influenced by content extracted from the walkthrough file.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from repository files (code, specs, ADRs), creating an attack surface for indirect prompt injection where malicious instructions in those files could manipulate the agent.
Ingestion points: Feature code files, docs/*.md specifications, and Architecture Decision Records (ADRs) found in the repository.
Boundary markers: No explicit delimiters or instructions are provided to the subagent to ignore instructions within the ingested data.
Capability inventory: The skill has capabilities for file reading, writing to the .scratchpad/ directory, and executing local Python scripts.
Sanitization: No input sanitization or validation of the content within the ingested files is performed before processing.

feature-walkthrough