The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its data ingestion and processing capabilities.
Ingestion points: The WebFetch tool is utilized to extract content from user-provided URLs for analysis, as described in the command options and workflow in SKILL.md.
Boundary markers: While the skill requires suggestions to be formatted as INS-XXX entries, it lacks explicit instructions for the agent to disregard potential instructions embedded within the external content fetched via WebFetch.
Capability inventory: The skill has the capability to write to project-critical documents such as 01-requirements.md, 02-system-design.md, and various documentation files within the docs/devdocs/ directory.
Sanitization: No explicit content sanitization or instruction filtering is implemented for external data; however, the skill mandates a human-in-the-loop confirmation step using AskUserQuestion before any requirements are officially committed, which serves as a robust mitigation for this risk.

insights