The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to "Load any skills named by the spec." This creates a dynamic loading mechanism where data within a project specification file can influence and expand the agent's active instruction set and tool capabilities at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injection because its primary function is to ingest and follow instructions from external project files (READMEs and specification files).
Ingestion points: repo README, spec README, and slice files mentioned in SKILL.md.
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore embedded commands within the specification data.
Capability inventory: The skill utilizes file system modifications, git command execution, subagent spawning, and external browser harness operations.
Sanitization: No sanitization or validation of the specification content is mentioned before it is used to drive agent actions.
[COMMAND_EXECUTION]: The skill uses shell-level operations including git worktree, git status, and git diff, and orchestrates browser-based verification harnesses. While standard for development, these are triggered automatically during the implementation loop.
[REMOTE_CODE_EXECUTION]: The skill implements a delegation model that spawns concurrent subagents to execute independent passes. This creates a complex execution environment where secondary agents are triggered based on the specification graph, potentially executing unverified logic if the graph is manipulated.
[PROMPT_INJECTION]: The skill contains highly autonomous instructions such as "no pause for acknowledgement" and "never idle," which, while intended for efficiency, discourage human-in-the-loop verification and could allow a malicious instruction sequence to proceed further before intervention.

implement-spec