The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates a vulnerability to indirect prompt injection because it incorporates untrusted data from the local environment into its processing logic.
Ingestion points: The skill reads project context from AGENTS.md, milestone data from production/milestones/, and scans the entire codebase for comments (TODO, FIXME, HACK).
Boundary markers: There are no defined delimiters or instructions provided to the agent to treat the content of these files as data rather than instructions.
Capability inventory: The skill is granted Read, Glob, Grep, and Write tools, allowing it to modify the file system based on potentially poisoned input.
Sanitization: The skill lacks logic to sanitize or validate the content of the files it reads before using them to generate the final checklist and rationale.

release-checklist