The Agent Skills Directory

[PROMPT_INJECTION]: The skill is configured for autonomous execution, explicitly instructing agents to skip user confirmation between tasks ("Не спрашивай разрешений между задачами") and to resolve issues independently ("Не спрашивай пользователя — исправляй и продолжай"). This high level of autonomy increases the potential impact of subverted instructions.
[PROMPT_INJECTION]: The skill processes untrusted task descriptions from "tasks.md" and "design.md" by interpolating them into subagent prompts using the {{TASK_TEXT}} placeholder. This creates a surface for indirect prompt injection where malicious instructions in the task files could influence subagent behavior.
Ingestion points: Content from tasks.md and design.md are read via the Read tool and passed to the Task tool.
Boundary markers: The prompt templates in implementer-prompt.md and reviewer-prompt.md utilize markdown headers and variable placeholders but do not implement robust sanitization or explicit delimiters to prevent command leakage from the task text.
Capability inventory: The subagents have access to tools including Bash, Write, Edit, and the Task tool for spawning additional agents.
Sanitization: No validation or filtering is applied to the ingested file content before interpolation into the prompt.

subagent-dev