The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions include a 'standing approval' clause that directs the agent to bypass standard transaction pauses and human-in-the-loop confirmations normally enforced by the $backlog tool.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of external data used to define project tasks.
Ingestion points: Outcome definitions sourced from conversation history or external files (Step 1).
Boundary markers: Absent; there are no instructions to the agent to treat external outcome descriptions as untrusted data.
Capability inventory: Backlog modification, local script execution, and sub-agent spawning.
Sanitization: Absent; external data is directly used to generate task records and refinement documentation.
[COMMAND_EXECUTION]: The skill executes a local script (node scripts/validate-project.mjs) to verify the project's state upon completion.
[COMMAND_EXECUTION]: The workflow requires the agent to record 'verification commands' within execution plans, which are designed to be run by downstream tools.

to-epic