The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, potentially untrusted artifacts such as PRDs, research documents, and design discussions. These files provide an attack surface for indirect prompt injections aimed at influencing the agent's product decisions or requirement refinement.
Ingestion points: SKILL.md (Step 1) instructs the agent to "Read every file in the task directory" and "Read every additional path named by the user"; references/feedback-resolution.md includes fetching comments from external artifacts.
Boundary markers: The instructions do not specify the use of delimiters or clear "ignore instructions" wrappers when the agent processes and interpolates this external content.
Capability inventory: The agent has capabilities to read arbitrary local files, modify the PRD document at its original path, and create or update HTML mockups in the task directory.
Sanitization: There are no explicit instructions to sanitize, escape, or filter content retrieved from external sources.
[DATA_EXFILTRATION]: The skill enables a potential data exposure vector by instructing the agent to "Read every additional path named by the user." If a malicious indirect prompt injection within a project artifact (like a research paper or ticket) provides a sensitive file path (e.g., ~/.ssh/config or .env), the agent may ingest that sensitive data into its session context or include it in its internal "resolution ledger."
[COMMAND_EXECUTION]: SKILL.md directs the agent to utilize the shell command ls -La to inventory the task directory. While this is a standard administrative command used for environment discovery, it indicates that the skill relies on shell command execution to perform its file management tasks.

iterate-prd