The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data during its intake phase which presents an indirect prompt injection surface.
Ingestion points: Specification content is retrieved from external issue URLs or user-pasted text as described in SKILL.md Phase 0 (Intake).
Boundary markers: The skill lacks explicit instructions for using delimiters or boundary markers to isolate external specification content from its own instructional framework.
Capability inventory: The skill has the capability to write files to the local repository (docs/draft/ and docs/plans/) and interact with the user via structured questions (AskUserQuestion), which could be influenced by malicious content in a specification.
Sanitization: There are no explicit requirements or steps defined to sanitize, validate, or filter the content of ingested specifications before they are processed by the agent.

create-dev-plan