The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data (project source code and user-provided playbooks) and passes it to a sub-agent, creating a surface for indirect prompt injection.
Ingestion points: Source files identified via the find command and architectural playbooks accessed via the Read tool in SKILL.md.
Boundary markers: Absent; the sub-agent prompt does not use delimiters or explicit instructions to ignore embedded commands in the ingested data.
Capability inventory: The sub-agent has access to the Bash and Agent tools, which could be abused if an injection is successful.
Sanitization: No filtering or sanitization of ingested file content was detected before interpolation into the sub-agent's prompt.
[SAFE]: The skill implements a robust safety mechanism using isolated Git worktrees (git worktree add) to ensure that all generated tests and modifications are isolated from the main development branch.
[SAFE]: A strict quality gate is enforced in SKILL.md to verify that zero production code changes have occurred (git diff --name-only | grep -v test | wc -l) before completion.
[SAFE]: The skill uses standard, well-known development tools including vitest, jest, pnpm, and git without evidence of malicious command construction or obfuscation.

layer-testing