The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data by reading existing codebase files and documentation to reconstruct architectural decisions. This creates a surface for Indirect Prompt Injection where malicious instructions could be embedded in code comments or markdown files to influence the agent's logic during Phase 1 (Discovery) or Phase 2 (Drafting ADRs).
Ingestion points: The skill reads code and documentation files using rg, fd, and Read tools in Phase 0 and Phase 1.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded prompts within the files being analyzed.
Capability inventory: The skill has Write and Edit permissions to create new files and can execute shell commands through multiple Bash tool variants (git, npm, pytest, etc.) as seen in the allowed-tools list and Phase 4/5.
Sanitization: There is no mention of sanitizing or escaping the content read from the codebase before it is used to generate the ADR or Gherkin specs.

backfill-feature