The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the user-provided task description. User input captured from the $ARGUMENTS variable is directly interpolated into the prompts used to spawn worker agents (analyst, architect, developer, and qa) without the use of boundary markers, sanitization, or escaping.
Ingestion points: The requirement field in the worker Agent prompt template (found in SKILL.md and roles/coordinator/commands/monitor.md) receives raw user-provided task descriptions.
Boundary markers: The skill fails to use delimiters (such as XML tags or unique markers) or "ignore instructions" headers to separate the requirement context from the worker's operational instructions.
Capability inventory: The spawned worker agents have access to sensitive capabilities across all scripts, including Bash (command execution), Write/Edit (file system modification), and WebFetch (network operations).
Sanitization: There is no evidence of validation or filtering logic to ensure the user input does not contain instructions that override the worker agent's primary directives.

team-frontend