The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing untrusted data from the local repository.
Ingestion points: The procedure gathers context from README.md, CLAUDE.md, git log, and other markdown files in the coordinator's memory directory.
Capability inventory: The skill is capable of writing a new vision.md file to the filesystem.
Boundary markers: The instructions do not specify any delimiters or safety prompts to ensure the agent ignores embedded instructions within the source documents.
Sanitization: There is no mention of sanitizing or filtering the gathered content before it is used to draft the project vision.
Multi-step chain: The resulting vision.md is designed to be read by another agent component (agents/coordinator.md), which could allow malicious instructions in a project file to eventually influence the coordinator agent's behavior.

vision-bootstrap