The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it ingests and processes untrusted data from project files to determine scope and perform audits.
Ingestion points: The skill reads contents from docs/specs/, docs/roadmap/, docs/architecture/, and root-level manifests such as package.json and requirements.txt (SKILL.md).
Boundary markers: Absent. There are no explicit delimiters or instructions provided to the agent to treat interpolated file content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has the ability to write to the filesystem (docs/progress/), create directories, and spawn multiple sub-agents with different model capabilities (Opus and Sonnet) via the Agent tool.
Sanitization: Absent. No validation or filtering is performed on the data read from the local environment before it is used in prompt construction.
[COMMAND_EXECUTION]: The skill performs automated filesystem operations during its setup phase, including the creation of directory structures (e.g., docs/roadmap/, docs/specs/) and initialization of .gitkeep files.

review-quality