The Agent Skills Directory

[PROMPT_INJECTION] (LOW): The skill is vulnerable to indirect prompt injection (Category 8). User-provided feature descriptions and constraints are gathered in Step 1 and subsequently passed to the technical-discussion skill in Step 3.
Ingestion points: User input gathered via references/gather-feature-context.md.
Boundary markers: Absent. The user input is interpolated directly into a template for the next skill call in references/invoke-discussion.md.
Capability inventory: The skill can execute bash commands and invoke other processing skills.
Sanitization: Absent. There is no filtering or escaping of the user-provided text before it is used to influence the agent's behavior in the discussion phase.
[COMMAND_EXECUTION] (LOW): The skill utilizes local bash scripts for operational tasks.
Evidence: SKILL.md defines a PreToolUse hook that executes $CLAUDE_PROJECT_DIR/.claude/hooks/workflows/system-check.sh and an allowed tool call to .claude/hooks/workflows/write-session-state.sh in Step 3.
Context: While these are local scripts intended for environment verification and session persistence, they represent a command execution surface that relies on the integrity of the .claude directory within the project environment.

start-feature