The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from the local repository.
Ingestion points: The agent is instructed in SKILL.md to read repository instructions, the supplied task, and relevant code or documentation.
Boundary markers: No delimiters or specific instructions to ignore embedded commands are present to protect the agent context.
Capability inventory: The skill allows the agent to update existing spec artifacts or create new Markdown files.
Sanitization: There is no evidence of sanitization or validation of the content read from the repository.
[EXTERNAL_DOWNLOADS]: The documentation references and suggests the installation of code from an external, third-party source.
Evidence: SKILL.md identifies https://github.com/mattpocock/skills as a source for companion skills and provides the command npx skills add mattpocock/skills --skill <name>.
Context: This suggests the use of third-party code to extend the agent's capabilities.

task-spec