The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content from the web and project files without sufficient isolation.
Ingestion points: The skill performs web research to investigate "external practices, products, or known pitfalls" and reads existing project specifications and code in Step 1.
Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores any instructions or malicious patterns found within the researched content or files.
Capability inventory: The skill has the capability to write files to the local filesystem (specifically proposal.md in the ~/.agent-skills/changes/ directory) and use the codagent:ask-questions tool to interact with the user.
Sanitization: Absent. The skill does not specify any validation or filtering for the data retrieved from external sources before it is used to generate the proposal.

propose