The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content that could contain hidden instructions to influence agent behavior.
Ingestion points: The skill ingests user input ($ARGUMENTS), web research results, and local codebase contents (Phase 2 in SKILL.md).
Boundary markers: Prompt templates in references/brainstorm-protocols.md lack explicit delimiters or instructions to ignore embedded commands within the research material.
Capability inventory: The skill can read project files via agent-explorer, write arbitrary files to the filesystem (Phase 5d in SKILL.md), and execute shell commands and external packages (Phase 3f and references/brainstorm-protocols.md).
Sanitization: No sanitization or filtering logic is present to validate synthesized research before it is used for technical decisions.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes an external package from a public registry at runtime without a pinned version.
Evidence: The Documentation Lookup Prompt Template in references/brainstorm-protocols.md specifies the use of bunx ctx7@latest to fetch documentation from npm.
[COMMAND_EXECUTION]: The skill executes shell commands derived from codebase configuration files, which could lead to code execution if the manifests are compromised.
Evidence: Phase 3f in SKILL.md identifies and executes commands such as cargo check, cargo clippy, and bun run typecheck based on the detected project tech stack.

write-prd