The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is highly autonomous and explicitly instructs the agent to avoid asking for user confirmation between tasks ("Не спрашивает разрешений", "решай сам"). This design significantly increases the impact of indirect prompt injection if the input data is untrusted.- Ingestion points: Untrusted task descriptions are read from tasks.md and interpolated into sub-agent prompts via the {{TASK_TEXT}} placeholder in implementer-prompt.md and reviewer-prompt.md.- Boundary markers: The skill lacks delimiters or explicit instructions to ignore embedded commands within the task text, making it easier for an attacker to hijack the sub-agent's behavior.- Capability inventory: The sub-agents have access to a wide range of powerful tools, including Bash, Write, Edit, and specialized code compilation skills, which could be abused if the agent follows malicious instructions.- Sanitization: There is no evidence of sanitization or validation of the content within tasks.md before it is processed.- [COMMAND_EXECUTION]: The skill uses the Bash tool for repository management (git rev-parse, git diff) and grants sub-agents shell access to perform development tasks. While these are intended functions, the lack of human oversight during the autonomous loop makes these capabilities a potential vector for abuse if the task input is compromised.

subagent-dev