The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external sources such as git repositories, task notes, and project artifacts, which could contain malicious instructions.
Ingestion points: Data enters the agent context through tools described in SKILL.md such as note_get, item_get, artifact_get, search, overview, and next.
Boundary markers: The skill does not define specific delimiters or instructions to treat data returned from these tools as untrusted content.
Capability inventory: The skill includes tools for file modification (artifact_add, artifact_update, note_add) and code execution (via 'executable gates' in sprint_close and item_done), providing a significant impact surface for injection attacks.
Sanitization: There is no mention of escaping or sanitizing the content retrieved from these external sources before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill documents the use of 'executable gates' and coverage commands that allow for runtime code execution. Tools like item_add and item_update allow users to define executable gates, and sprint_close and item_done execute these gates to verify task status. Additionally, the sprint_close tool accepts a command parameter within its coverage configuration to execute shell commands for generating coverage reports.

using-sprinty