The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from existing research files and external links that could contain malicious instructions designed to influence the agent's behavior during the scaffolding process.
Ingestion points: The agent reads data from docs/research/, docs/screens/INDEX.md, and user-provided files or links from a specs/ folder.
Boundary markers: Absent. The instructions do not direct the agent to use delimiters or ignore embedded instructions when reading these files.
Capability inventory: The skill has file system write access (e.g., docs/BRIEF.md, docs/STORIES.md, docs/SPEC.md) and invokes downstream tools like new-windows-app and user-stories.
Sanitization: Absent. The skill explicitly instructs the agent to copy content blocks (Brief and Stories) directly into the generated documentation files without validation or filtering.
[COMMAND_EXECUTION]: The skill requires the agent to inspect the local file system to verify if a chosen application name is already in use.
Evidence: The instructions command the agent to check the Start menu and the %LOCALAPPDATA%\Programs directory to avoid naming conflicts with installed software.
[EXTERNAL_DOWNLOADS]: The skill allows for the retrieval of data from external sources provided by the user.
Evidence: Step 1 allows the user to provide a "link" to a spec file, which the agent is expected to fetch and process to populate the application brief.

app-brief