The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various sources which could contain malicious instructions designed to influence the agent's behavior during the design iteration process.
Ingestion points: In Step 1 of SKILL.md and the intake rules in references/feedback-and-resolution.md, the skill is instructed to read all files in the task directory (.agent-work/tasks/<task>/) and fetch artifact comments from the environment.
Boundary markers: While the skill is instructed to keep "feedback threads, decision logs, and patch chronology out of the design narrative" in SKILL.md, it lacks explicit instructions to treat all content from these external sources as data only and to ignore any embedded directives.
Capability inventory: The skill possesses the capability to modify existing technical design documents and create new HTML-based diagram artifacts within the task directory based on the ingested feedback.
Sanitization: The instructions do not specify any validation, filtering, or escaping of the content retrieved from artifact comments or task files before it is processed or incorporated into the design documents.

iterate-tdd