The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill set contains multiple ingestion points for untrusted external data which the agent is then instructed to process in a reasoning loop.
Ingestion points: code-to-prd/scripts/codebase_analyzer.py (analyzes external codebases and extracts functional specs), product-manager-toolkit/scripts/customer_interview_analyzer.py (processes user interview transcripts for NLP analysis), and research-summarizer/scripts/extract_citations.py (parses academic and web research documents).
Boundary markers: The scripts do not output content within clearly defined security boundaries (like XML tags or multi-line delimiters) and do not include specific instructions for the model to ignore any embedded commands within the extracted content.
Capability inventory: The skill set includes powerful capabilities that could be abused if an injection is successful, including file creation/writing (project_bootstrapper.py, landing_page_scaffolder.py) and shell command execution (changelog_generator.py).
Sanitization: No evidence of escaping or filtering natural language instructions was found in the data processing pipelines.
[COMMAND_EXECUTION]: The script roadmap-communicator/scripts/changelog_generator.py executes system commands to retrieve metadata.
Evidence: The script uses the subprocess.run module to call the git log command for the purpose of reading commit history and prefixes.
Context: The implementation is safe against shell injection as it uses list-based arguments rather than a raw shell string; however, any execution of external binaries represents a security surface that relies on the host environment.

product-skills