The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external specification documents and task tickets to drive its automated implementation and sub-agent coordination logic.
Ingestion points: The skill reads specifications and tickets (referenced in SKILL.md) which serve as the primary source of instructions for subsequent actions.
Boundary markers: There are no defined delimiters or instructions to treat content from tickets as untrusted data.
Capability inventory: The skill possesses capabilities to create branches, draft PRs, manage worktrees, and spawn sub-agents for implementation and code review.
Sanitization: The instructions do not include any validation or sanitization steps for the external data ingested from the tickets.
[DATA_EXFILTRATION]: The skill instructions direct the agent to store research notes outside the project's repository boundaries.
Evidence: SKILL.md instructs the "probing sub-agent" to save Markdown notes in a directory located outside the repository to ensure access for other sub-agents.
While intended for state sharing, writing data to arbitrary locations outside the controlled repository environment can be used to move sensitive project information to unmonitored areas of the filesystem.

implement-spec