The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill processes untrusted markdown files from the plans/ directory to extract architectural requirements.
Ingestion points: Multiple files in plans/ are read using cat and grep commands as defined in workflow.md.
Boundary markers: No delimiters or protective instructions are used to distinguish between data and commands within the plans.
Capability inventory: The skill can execute shell commands (cargo, rg, grep) and has the capability to write/edit its own configuration files.
Sanitization: Extracted data is not sanitized before being used to influence agent behavior or update instructions.
Dynamic Execution (MEDIUM): The self-learning.md framework explicitly instructs the agent to modify its own source files and agent configuration (.claude/agents/architecture-validator.md) based on runtime observations.
Evidence: The "Self-Update Protocol" Phase 3 instructs the agent to edit its own skill and agent files to "Update validation logic." This self-modifying behavior allows temporary or persistent changes to the agent's core logic based on external inputs.
Command Execution (SAFE): The skill uses standard local tools like grep, find, and cargo tree for codebase analysis, which is consistent with its primary purpose and limited to the local development environment.

architecture-validation