The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data, such as user-supplied task descriptions and existing repository files, without defining specific sanitization or boundary markers. This creates an indirect prompt injection surface where malicious instructions embedded in a project's source code or task briefs could influence the agent's behavior during the build or validation phases.
Ingestion points: User-provided task text, brief files (via path-to-brief), and repository content skimmed during the CALL and RESEARCH phases (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when interpolating external content into agent prompts.
Capability inventory: Across its workflow, the skill has the capability to write to the filesystem and execute shell commands resolved from repository manifests.
Sanitization: There is no evidence of validation or filtering for data ingested from the repository or user input.
[COMMAND_EXECUTION]: The skill is designed to automatically resolve and execute shell commands based on local repository manifests like package.json, pyproject.toml, or Cargo.toml (references/stack-adapters.md). While this is a standard requirement for a development tool to run tests and linters, it provides an execution path for arbitrary commands if a repository's configuration files are maliciously modified.

nuke-sprint