The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) during its audit and fix loop. It consumes findings generated by the /review-change skill and passes them to the agents/fix-applier.md task for execution. This creates a multi-step chain where untrusted data (code or documentation in the repository) can influence agent behavior.
Ingestion points: Phase 3 finding packets derived from the codebase via the /review-change tool.
Boundary markers: None explicitly implemented to separate review findings from core agent instructions.
Capability inventory: The skill possesses significant capabilities through orchestration, including the ability to write to the filesystem (Write, Edit tools), execute commands (Bash tool), and invoke other agents (Skill, Task tools).
Sanitization: There is no evidence of sanitization or validation of the findings content before it is dispatched to the fix-applier agent.

drive-plan