The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill's core workflow involves extracting task descriptions from external files (documented in SKILL.md Step 1) and passing them as instructions to implementer subagents.
Ingestion points: Implementation plans are read from the repository (e.g., docs/plans/feature-plan.md) and treated as authoritative specifications.
Boundary markers: The prompt templates in implementer-prompt.md, fix-prompt.md, and spec-reviewer-prompt.md lack explicit delimiters (like XML tags) or instructions to disregard malicious prompts embedded within the interpolated task text.
Capability inventory: Dispatched subagents have extensive capabilities, including creating/modifying files, running shell commands (TDD), and committing changes to the repository via tools such as Agent, Task, spawn_agent, and invoke_agent.
Sanitization: The skill does not implement validation or sanitization of plan content before it is used to generate prompts for subagents.
[COMMAND_EXECUTION]: Delegated Command Ownership. The skill framework assigns verification scopes (worker-red-green, worker-ceiling) to subagents, who are then responsible for executing repository-defined commands. While intended for testing and validation, these capabilities could be exploited if a subagent is compromised via the indirect injection surface mentioned above.

subagent-driven-development