The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by design. It ingests data from external, potentially untrusted sources such as Jira tickets (Refine/Estimate modes), Figma design artifacts, and existing codebase files. This external content is interpolated into subagent instructions using placeholders like {FEATURE_DESCRIPTION}, {ACCEPTANCE_CRITERIA}, and {SPEC_CONTENT}.
Ingestion points: User feature requests, Jira ticket descriptions/metadata, Figma MCP output, and codebase exploration results from the Refinement subagent.
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or ignore embedded instructions when processing external data.
Capability inventory: The skill has the capability to create and update Jira tickets, write new specification files to the repository (enggenie/spec_[slug].md), and execute shell commands via git.
Sanitization: Absent. There are no explicit sanitization or validation steps for content pulled from Jira or Figma before it is processed by the LLM subagents.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands (git status and git branch -a | grep <slug>) to validate the workspace state. While these are routine development operations, the use of a user-derived slug identifier within a shell command string presents a potential command injection vector if the agent does not strictly enforce the kebab-case format constraint before execution.

pm-refine