The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a substantial surface area for indirect prompt injection attacks due to its core information-gathering workflows.
Ingestion points: The PM and Architect agents are instructed to use WebSearch and WebFetch tools to retrieve external content from the internet when clarifying requirements or conducting technical research (agents/boss-pm.md, agents/boss-architect.md).
Boundary markers: The skill's shared protocols and agent instructions do not implement the use of clear delimiters or explicit 'ignore embedded instructions' warnings for content fetched from external sources.
Capability inventory: Agents involved in the pipeline have high-privilege tool access, including Bash for shell execution, Write/Edit for file system manipulation, and the ability to spawn sub-agents (agents/boss-backend.md, agents/boss-frontend.md).
Sanitization: The skill does not perform sanitization or filtering of external data before it is processed by the agents.
[DYNAMIC_EXECUTION]: The skill's architecture is built on an extensible plugin system that loads and executes local code.
Evidence: Custom 'gate' plugins are executed as part of the quality assurance process, involving the loading of local JavaScript files (gate.js) through the runtime (references/extending-boss.md, cli/runtime/application/gates.js).
Evidence: The /boss:extend command allows for the automated generation of new agents and plugins, writing .md and .js files to the .boss/ directory which are subsequently used by the orchestrator (commands/boss-extend.md).
[COMMAND_EXECUTION]: Automated command execution is a primary component of the skill's development workflow.
Evidence: Multiple agents (Backend, Frontend, QA, DevOps) are tasked with executing shell commands for dependency management, testing, and deployment, such as npm install, vitest, and docker-compose (agents/boss-devops.md, references/testing-standards.md).
Mitigation: The skill implements a security hook (scripts/hooks/pre-tool-bash.js) that monitors shell usage and blocks known dangerous patterns, including rm -rf, chmod 777, and DROP TABLE commands.

boss