The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the local repository and incorporates it into the agent's context.
Ingestion points: Reads project documentation (AGENTS.md), milestone files (production/milestones/*), release history (production/releases/*), and content calendars (design/live-ops/content-calendar.md). It also performs broad codebase scans via Grep for patterns like TODO or FIXME.
Boundary markers: The instructions do not define clear delimiters (e.g., XML tags or unique string markers) to separate the content of files from the agent's instructions, nor do they instruct the agent to ignore instructions embedded within the files it reads.
Capability inventory: The skill has access to Read, Glob, Grep, and Write tools, allowing it to inspect the filesystem and create new markdown files.
Sanitization: There is no evidence of sanitization or validation performed on the text extracted from the codebase before it is used to populate the launch checklist.

launch-checklist