The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data, such as PRD documents and source code, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The workflow reads requirement documents (_prd.md, _techspec.md, _tasks.md), architectural records (ADRs), and implementation source code from the repository.
Boundary markers: The instructions do not specify the use of clear delimiters or "ignore embedded instructions" warnings when interpolating this data into the agent's context.
Capability inventory: The skill possesses the ability to execute shell commands (make lint, git diff, cy-final-verify) and write multiple markdown files to the repository's .compozy directory.
Sanitization: There is no mention of explicit sanitization or filtering of the external content before it is reviewed or written to the generated issue files.
[COMMAND_EXECUTION]: The skill executes local system commands to identify code changes and verify the integrity of the review results.
Evidence: The skill runs git diff to determine the review scope, make lint to filter out common styling or simple logic errors, and a verification tool cy-final-verify to ensure the generated issue files are correctly formatted.

cy-review-round