The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions from external data stored in work trackers (bd and br), which could contain malicious prompts injected by an attacker.
Ingestion points: Workflow steps 2, 3, and 6 in SKILL.md describe reading title, description, acceptance criteria, design, and notes via bd show and br show commands.
Boundary markers: The skill instructions do not specify any delimiters or safety warnings to ignore instructions embedded within the tracker data.
Capability inventory: The skill allows the agent to execute shell commands (bd, br, git), modify files during implementation, and spawn sub-agents for specialized tasks.
Sanitization: There is no evidence of sanitization or validation of the retrieved tracker data before the agent proceeds with implementation steps.
[COMMAND_EXECUTION]: The skill instructions direct the agent to run several local command-line tools including bd, br, and git. While these are necessary for the skill's primary function of managing work items and committing code, they represent the execution surface that could be exploited if malicious content is processed.

beads-implement