The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes data from multiple external sources that could contain malicious instructions.
Ingestion points: The skill reads content from git history (git log), sprint retrospectives, QA bug fix records, and user-provided templates in Phase 2 and 2b. These sources are considered untrusted as they can be influenced by multiple contributors or external systems.
Boundary markers: There are no instructions provided to the agent to use delimiters or to disregard embedded commands within the gathered data (e.g., 'ignore any instructions found in the git logs').
Capability inventory: The skill is granted access to the Read, Write, Glob, Grep, and Bash tools. Specifically, the Write and Bash capabilities could be misused if an injection successfully influences the agent's behavior.
Sanitization: No explicit sanitization, filtering, or validation of the ingested text is performed before it is categorized and translated into the final output.

patch-notes