The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's architecture involves reading local project files and intermediate analysis outputs which are then used as context for sub-agents, creating an attack surface where malicious workspace content could influence agent behavior.
Ingestion points: phases/03a-ui-design-exploration.md reads project-specific configuration files such as package.json, pubspec.yaml, and Cargo.toml. phases/04-synthesis.md reads all role-specific analysis files (analysis*.md) to perform cross-role synthesis.
Boundary markers: The instructions for spawning the conceptual-planning-agent in phases/03-role-analysis.md, phases/03a-ui-design-exploration.md, and phases/04-synthesis.md lack explicit delimiters (e.g., XML tags or unique markers) or instructions for the sub-agents to ignore embedded directives within the interpolated content.
Capability inventory: The skill is authorized to use Skill(*), Agent(...), Read, Write, Edit, Glob, and Bash(*). These capabilities allow for substantial filesystem and tool-based operations based on the processed context.
Sanitization: There is no evidence of filtering, escaping, or validation logic applied to the external content before it is incorporated into the prompt context for sub-agents.

brainstorm