The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the deferred-work ledger and arbitrary project files, creating a vulnerability surface for indirect prompt injection.
Ingestion points: The agent is instructed to read {implementation_artifacts}/deferred-work.md, its archive file, and any source code files specified in the location: field of ledger entries (Step 2).
Boundary markers: Absent. The instructions do not define delimiters or provide warnings to ignore embedded instructions within the data being triaged or the code being verified.
Capability inventory: The agent has the ability to read arbitrary files in the project tree, execute shell commands (grep, git log), write to a JSON result file, and spawn sub-agents.
Sanitization: Absent. The skill does not include steps to sanitize or validate the content of the ledger or code before using it to make triage decisions or partitioning work.
[COMMAND_EXECUTION]: The skill uses shell-based tools to verify the status of issues in the codebase.
Evidence: Step 2 of SKILL.md directs the agent to 'grep for the symptom' and 'check git log for commits that touched the area'.
Risk: If the metadata in the ledger (such as the location or the search 'symptom') contains shell metacharacters, it could lead to command injection if the agent executes these tools by concatenating the input into a shell string.
[DYNAMIC_EXECUTION]: The skill is authorized to spawn additional autonomous agents to assist in its tasks.
Evidence: Step 2 of SKILL.md states: 'Use sub-agents for parallel verification when available; never ask permission.'
Risk: The use of sub-agents expands the execution environment and can increase the impact of a successful prompt injection, as the primary agent can delegate malicious instructions to sub-agents without human oversight.

bmad-loop-sweep