The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes external data such as command logs, diffs, and verification evidence to generate its summary. An attacker could embed instructions within these logs to influence the agent's final report or routing decisions.
Ingestion points: The skill reads diff, 验证命令/日志 (verification commands/logs), and Task Graph as part of its completion check (found in SKILL.md).
Boundary markers: There are no defined delimiters or specific instructions for the agent to disregard potential commands found within the external evidence.
Capability inventory: While the skill itself is limited to reading and summarizing, the output influences the Ledger Update and the Recommended Next Stage, which includes development and PR actions.
Sanitization: The instructions do not provide mechanisms for escaping or validating the content of the external logs before they are incorporated into the prompt context.

ccdawn-completion-summary