The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from ticket manifests, task plans, and codebase source files that could contain malicious instructions.
Ingestion points: Processes MAIN_PLAN_FILE, various artifact files (e.g., docs/<KEY>-stage-1-detailed.md), and local project files during codebase verification.
Boundary markers: The instructions in SKILL.md and subagents/critique-analyzer.md explicitly mandate that external content and fetched pages be treated as reference data only, stating they must not override the skill's authoritative instructions or host runtime rules.
Capability inventory: Possesses filesystem read/write capabilities (restricted to markdown orchestration artifacts) and network fetch capabilities for evidence gathering.
Sanitization: The architecture uses subagent isolation to compartmentalize data processing, and output artifacts are validated against specific markdown templates before being finalized.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external URLs to provide rationale and evidence for its critiques.
The network activity is primarily guided by a source map in references/external-sources.md which points to well-known technical and design thinking resources (e.g., Anthropic, Atlassian, Thoughtworks, Nielsen Norman Group).
The critique-analyzer subagent may fetch official project documentation for named dependencies discovered within the user's repository, but these are handled as reference data for evidence-based decision making.

clarifying-assumptions