The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content including Product Requirement Documents (PRDs), RFCs, and web search results. This creates a surface for indirect prompt injection attacks where malicious instructions could be embedded in the processed data. The skill proactively mitigates this risk by providing the agent with a formal 'Untrusted Content' reference file that establishes clear boundaries for handling non-authored text.
Ingestion points: External data enters the agent context in instructions/specify.md (Domain lookup via web search or external documents), instructions/design.md (Research using docs MCP or search), and instructions/validate.md (Retrieving DOM, console output, and network responses from live applications).
Boundary markers: The skill includes a robust security reference in references/untrusted-content.md which instructs the agent to treat all non-authored text as data only, ignore any embedded instructions (regardless of claimed authority), and never use external content to determine tool parameters.
Capability inventory: The skill possesses significant capabilities via its allowed-tools in SKILL.md, including shell execution via Bash(python3:*) and Bash(git:*), as well as file system operations (Read, Write, Edit). Internal Python scripts scripts/lint_artifact.py and scripts/select_tasks.py are used for logic processing and are verified safe.
Sanitization: The references/untrusted-content.md guidelines serve as the primary sanitization mechanism by enforcing strict isolation between data processing and instruction execution. Furthermore, instructions/validate.md explicitly prohibits executing JavaScript to access stored credentials (cookies, localStorage).

spec-driven