The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its research workflow.
Ingestion points: The agent is instructed to perform targeted online research using official docs, source repositories, papers, and case studies (Workflow Step 2).
Boundary markers: There are no defined delimiters or instructions for the agent to ignore potentially malicious directions embedded within the researched external content.
Capability inventory: The skill can spawn subagents that run or build code, create various specification files, and synthesize technical architecture plans that guide subsequent development.
Sanitization: No sanitization or validation of content from external links is performed before it is integrated into the planning process.
[REMOTE_CODE_EXECUTION]: The workflow explicitly encourages the execution of untrusted external code. It instructs the agent to identify "exemplars" from research and "turn any exemplar into a reproduction spike" before implementation (Workflow Step 2). This promotes the download and execution of code from arbitrary third-party repositories within the user's environment.
[COMMAND_EXECUTION]: The parallel drafting process involves spawning multiple subagents that may "run or build to validate" their proposed plans in separate git worktrees (Workflow Step 3). This grants the skill the capability to execute shell commands and build processes dynamically during the planning phase.

write-spec