The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process multiple documents within a project repository, such as AGENTS.md, ROADMAP.md, and various 'Papers' (White, Yellow, Green, etc.). This content ingestion creates an attack surface for indirect prompt injection.
Ingestion points: The agent is directed to read AGENTS.md (SKILL.md), existing Markdown papers in the papers/ directory, and roadmap or PRD documents in the docs/ directory (roadmap.md, prd.md).
Boundary markers: While the skill uses structural conventions like version pins, it lacks technical delimiters (e.g., XML tags or specific code blocks) to isolate untrusted file content from instructions.
Capability inventory: The agent has permissions to write and amend Markdown files throughout the papers/ and docs/ folders and is prompted to use vendor-specific linting tools.
Sanitization: No specific mechanisms for sanitizing, escaping, or validating the content of these external repository files are mentioned before the agent processes them.
[EXTERNAL_DOWNLOADS]: The skill references installation commands for related tools (xy-agent, xy-toolchain, xy-development) using npx skills add.
Evidence: The commands reference the ariestools/ariestools-skills repository.
Context: These are official resources from the skill's author ('ariestools') and are part of the intended product planning ecosystem.
[NO_CODE]: The skill consists entirely of Markdown documentation and instructions. No executable scripts (Python, JavaScript, etc.) are included in the skill package.

xy-product-plan