The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from technical design documents and external model review tool outputs, creating a vulnerability surface for indirect instructions.
Ingestion points: The skill reads 6-design.md from a user-specified artifact directory and captures raw output from external vendor CLIs via external-review.mjs.
Boundary markers: The methodology uses a "fence-length containment rule" and a designated "untrusted-content line" header to isolate external data within DATA blocks.
Capability inventory: The invoking session uses Bash for discovery and review execution, and dispatches a subagent via the Agent tool. The subagent (Explore) is constrained by instruction to read-only tools (Read, Grep, Glob, Skill) to prevent unauthorized modifications.
Sanitization: The instructions require a "paraphrase-only" disposition for external claims and employ "last-verdict-token derivation" to ensure the final verdict status (e.g., APPROVE) is determined by the reviewer's logic rather than injected strings.
[COMMAND_EXECUTION]: The skill utilizes the host's Bash environment to execute local scripts and tools as part of the engineering workflow.
Evidence: SKILL.md contains instructions to invoke discover-topic.sh and external-review.mjs using the Bash tool, incorporating user-supplied path arguments.

eng-design-doc-review