The Agent Skills Directory

[PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its core function of processing untrusted data from project diffs and task descriptions.
Ingestion points: SKILL.md (Workflow steps 1 and 4) instructs the agent to read KANBAN.md and local file diffs or pull requests.
Boundary markers: Absent; there are no specific markers or instructions to treat content in diffs or cards strictly as data rather than instructions.
Capability inventory: SKILL.md defines capabilities for writing formal handoff files to the local workspace directory.
Sanitization: Absent; the skill does not perform or specify validation of input data before analysis.
[SAFE]: No patterns of unauthorized command execution, remote code execution, or persistence were detected. The skill's file access is scoped to the local knowledge directory. Furthermore, the skill contains positive security guardrails in SKILL.md and references/checklist.md instructing the agent to stop and report sensitive data and to look for security issues during reviews.

delivery-review