The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the user to execute shell commands using the ! curl syntax to transmit base64-encoded answers from the local server back to the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted user input (notes, alternative answers, and custom decisions) via the local server and subsequently interpolates this content into agent-visible reports and summaries.
Ingestion points: Data enters via the POST /apply endpoint in scripts/server.mjs, which is processed by scripts/apply.mjs and scripts/lib.mjs.
Boundary markers: The skill uses labels like 'Settled', 'Deferred', and 'General note from the user' in its summaries but lacks explicit boundary markers or instructions to the LLM to ignore potentially malicious commands within that data.
Capability inventory: The skill has capabilities to read/write files in the workspace (including GLOSSARY.md and ADRs), spawn subprocesses, and trigger shell commands.
Sanitization: Input is tokenized and HTML-escaped for the web view, but the textual content is not sanitized for prompt injection before being presented back to the agent.
[EXTERNAL_DOWNLOADS]: The web interface provided by the skill (assets/round-template.html) downloads external resources, including the Mermaid.js library and Google Fonts, from public CDNs.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command pattern to allow users to trigger server-side updates and feed the resulting state back into the conversation context via terminal execution.

grill-visually