The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase and external research sources, creating a surface for indirect prompt injection attacks where malicious instructions could influence agent behavior.
Ingestion points: The workflow fetches external content using WebSearch and WebFetch in the specify phase (references/specify.md) and reads existing project files, including potentially attacker-controlled documentation or configuration, throughout the plan and execute phases (references/execute.md).
Boundary markers: The skill uses Markdown headers (##), template structures, and unique requirement IDs (PREFIX-NN) to isolate different data types. However, it lacks explicit developer-level instructions to ignore or sanitize prompts potentially embedded within the data it processes.
Capability inventory: The skill possesses significant capabilities, including shell access (bash), web browsing (WebSearch, WebFetch), and the ability to spawn subagents for parallel tasks (Agent, Workflow).
Sanitization: There is no evidence of specific sanitization or filtering logic for external data before it is presented to the agent or stored in artifacts.
[COMMAND_EXECUTION]: The skill identifies and executes shell commands for verification and testing, which are derived from the local environment and project files.
The agent is instructed to "learn the project's real test setup" by scanning files like CONTRIBUTING.md or package.json and then generating "gate" commands (references/plan.md). These commands are subsequently executed via the bash tool to verify task completion. If these project files have been maliciously modified, they could lead the agent to execute unintended or dangerous shell commands.

forge