The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read, analyze, and cite untrusted content from planning artifacts within a user's repository, creating an attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read task.json, prd.md, design.md, implement.md, implement.jsonl, and check.jsonl from the project repository (SKILL.md, Step 2).
Boundary markers: The skill uses a structured report template and mandates citations (finding-contract.md), but does not provide explicit instructions or delimiters to isolate or ignore potentially malicious instructions embedded within the reviewed artifacts.
Capability inventory: The skill has the ability to read arbitrary files in the repository, write reports to the .trellis/reviews/ directory, and execute standard git and internal Python scripts.
Sanitization: There is no evidence of escaping, filtering, or sanitization of the content extracted from the artifacts before it is interpolated into the final review report.
[COMMAND_EXECUTION]: The skill utilizes internal Python scripts and standard git commands to perform its audit functions.
Evidence: SKILL.md directs the agent to execute scripts/plan_precheck.py and scripts/write_review_report.py via the Bash tool.
Analysis: These scripts implement several security best practices, including validating task names against a restrictive regular expression (TASK_NAME_RE) and performing checks to prevent directory traversal or file system escapes through symlinks and reparse points (plan_precheck.py and write_review_report.py). The subprocess.run calls within these scripts are list-based and scoped to the git binary.

trellis-plan-review