The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, potentially untrusted sources to perform its analysis. This creates a surface where malicious instructions embedded in the analyzed content (such as design documents, source code, or git commit messages) could attempt to influence the agent's behavior.
Ingestion points: Reads files in design/, scans the general codebase, reads git log output, and extracts TODO/FIXME comments (Phase 1 and 2).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating the collected data into the final markdown report (Phase 3).
Capability inventory: The skill uses Read, Glob, Grep, and Bash tools.
Sanitization: There is no mention of escaping, filtering, or validating the content retrieved from the files or command output before it is processed by the model.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git log commands to determine the current state of the project. While this is a standard operation for its intended purpose, it involves executing shell commands based on runtime context.

scope-check