The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill reads from feature_list.json and .claude/autonomous-state.json to determine its next actions and the reason for its decisions.
Ingestion points: Reads feature_list.json and .claude/autonomous-state.json using json.load() in scripts/stop_hook_analyzer.py.
Boundary markers: None identified. The content from these files is interpolated directly into the 'reason' field and potentially returned to the agent context.
Capability inventory: The skill itself only performs file reads and logic checks, but it is designed to control the flow of an autonomous agent ('Two-Claude pattern'), which likely has broader capabilities.
Sanitization: The code does not sanitize the description or id fields from feature_list.json before including them in the reason string.
[Data Exposure & Exfiltration] (SAFE): The skill accesses local configuration files within the project directory. While these contain metadata about the project state, there is no evidence of hardcoded credentials or network exfiltration logic.

ac-stop-hook-analyzer