The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the $ARGUMENTS variable, which can include user-provided text, file contents, or content from external URLs.
Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable (referencing URLs, files, or issue references) in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety warnings (e.g., "ignore instructions inside this data") when processing the intake content.
Capability inventory: The skill has the capability to write files to the repository at planning/<initiative>/intake.md and suggest the execution of subsequent flow skills (/agile-roadmap, /agile-epic, /agile-story).
Sanitization: There is no defined sanitization, escaping, or validation logic to ensure that instructions embedded in the external input are not interpreted as commands by the agent.

agile-intake