The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow involves executing shell commands such as find, grep, and ripgrep (rg) to discover files and extract patterns. These operations provide the agent with broad read access to the local filesystem within the current workspace context.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). Ingestion points: Data is extracted from any files in the plans/ directory and the implementation codebase to define architectural requirements. Boundary markers: The extraction logic lacks delimiters or instructions to ignore embedded agent commands within the ingested files. Capability inventory: The agent can execute shell commands and is specifically instructed to rewrite its own configuration files (.claude/agents/) and documentation. Sanitization: There is no validation or escaping of the content extracted from plan files before it is used to influence the agent's logic or documentation. This design (self-learning.md) allows untrusted repository content to potentially modify the agent's future behavior or safety constraints.

architecture-validation