The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase data through Grep, Glob, and Read tools to provide context for parallel brainstorming agents.
Ingestion points: Codebase scanning in SKILL.md (Step 0) and Phase 1 context discovery in phase-workflow.md (Phase 1).
Boundary markers: Prompt instructions in phase-workflow.md and SKILL.md define complexity ceilings and architectural constraints for agents, although specific technical delimiters for external content are not explicitly detailed in the scripts.
Capability inventory: The skill utilizes Agent delegation, Bash command execution, Workflow orchestration, and TaskCreate for multi-step processing.
Sanitization: There is no explicitly documented sanitization or escaping logic for project data before interpolation into sub-agent prompts.
[DYNAMIC_CONTEXT_INJECTION]: The scripts/create-design-doc.md file contains shell commands using the !command syntax (e.g., date, git config, git log). These are used to auto-populate metadata fields in generated design documents. These commands are non-destructive and do not accept untrusted user input within the command string itself, making them safe for their intended purpose of document templating.
[EXTERNAL_DOWNLOADS]: The scripts/post_synth_podcast.py script downloads an .m4a audio file from a remote URL provided by the hq-content MCP server. The download is part of a vendor-linked feature for podcast synthesis and targets the vendor's own infrastructure.
[COMMAND_EXECUTION]: The skill executes various system commands through the Bash tool and shell-based hooks to detect project tiers and collect metadata. These commands (e.g., git, grep, glob) are used for reconnaissance and workflow management.

brainstorm