The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local files, creating a potential surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through the Evidence and constraints section, where the agent is instructed to read local paths and external URLs provided in the conversation (documented in SKILL.md).
Boundary markers: The skill employs clear defensive boundaries. The Source and Configuration Boundaries section and the Exact-Content Payloads section (in references/exact-content.md) provide instructions on using markdown fences and labeling content as inert-data to prevent the agent from following embedded instructions.
Capability inventory: The skill's capabilities are restricted to documentation-focused file writes (artifact-only mode) in docs/specs/, docs/decisions/, and docs/reports/findings/. It lacks high-risk tools like arbitrary shell execution or network exfiltration capabilities.
Sanitization: The instructions explicitly require the agent to treat outside-authored text as inert and state that if safe facts cannot be extracted without instructions, only a locator should be recorded.
[DATA_EXPOSURE]: The skill is designed to read file paths and project structures to gather evidence for the requirements spec. While this involves reading local data, the behavior is transparent, user-driven, and restricted to the documentation workflow.
[SAFE]: No evidence of malicious obfuscation, persistence mechanisms, privilege escalation, or unauthorized network operations was detected. The skill follows a principle of least privilege by scoping its 'artifact-only' effect class to specific directory trees.

vibe-requirements-spec