The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes content from untrusted files.
Ingestion points: Files are read from production/sprints/, production/session-state/active.md, and story files identified via Glob in Phase 1 and 2.
Boundary markers: The skill does not define delimiters (like XML tags or triple quotes) to separate untrusted document content from the instructions sent to subagents.
Capability inventory: The agent has access to the Write tool for file creation and the Task tool for spawning and prompting subagents.
Sanitization: There is no evidence of sanitization or content validation for the files read before they are interpolated into subagent prompts.

team-qa