The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external documents (Markdown, PDF, and screenshots via OCR), creating an attack surface for indirect instructions to influence agent behavior during parsing or classification.
Ingestion points: Files read via the Read tool in the parsing and change detection workflows (md, PDF, and images).
Boundary markers: The instructions do not define specific delimiters or "ignore" instructions to separate the untrusted PRD content from the agent's logic, making it vulnerable to embedded instructions.
Capability inventory: The skill uses Write to create local files, WebFetch for potential network access, and git mv for file management. The instructions specifically describe scanning Markdown for local file references (images) to copy them, which could be exploited via path manipulation in a malicious document to expose local files to the agent's context.
Sanitization: There is no mention of sanitizing the input text or validating referenced file paths beyond relative path checks.

prd-parser