The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly instructs the agent to read and copy files from ~/.claude/plans/. This directory is part of the agent's internal operational environment and may contain sensitive session metadata, history, or configuration data not intended for broad exposure.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands via the Bash tool, including system-level operations like brew install graph-easy and git branch management. It also executes a local Python script scripts/preflight_validator.py using the uv tool to validate project artifacts.
[PROMPT_INJECTION]: The skill includes a 'Self-Evolving Skill' instruction that directs the agent to 'fix this file [SKILL.md] immediately' upon encountering issues. This facilitates self-modifying behavior which could be exploited to bypass original constraints or permanently alter the agent's logic across sessions.
[PROMPT_INJECTION]: The skill implements a workflow that ingests data from ephemeral 'Global Plan' files stored in the agent's internal state directory. This represents an indirect prompt injection surface where unverified content from planning sessions is used to generate downstream code and documentation.
Ingestion points: ~/.claude/plans/<random-name>.md (referenced in SKILL.md and workflow-steps.md)
Boundary markers: None; the content is copied directly into new design specifications.
Capability inventory: File reading/writing, shell execution (Bash), and branch manipulation.
Sanitization: No validation or sanitization is performed on the content of the plan files before they are incorporated into the project's permanent documentation.

implement-plan-preflight