The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its session resumption mechanism. The agent is instructed to read existing documentation to determine project state, which could contain instructions intended to override agent behavior.
Ingestion points: In SKILL.md (Operating Rule 1), the agent is directed to read docs/CREATE-APP-PLAN.md and all artifacts in the Journey Map (such as PRODUCT.md and ARCHITECTURE.md) to resume progress.
Boundary markers: The instructions do not define boundary markers or provide explicit guidance to the agent to treat content from these files as untrusted or to ignore embedded commands.
Capability inventory: The agent has the ability to read and write files within the project directory and invoke other installed sub-skills based on the content of the documentation.
Sanitization: There is no logic provided to sanitize or validate the data ingested from the project's documentation files.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to the user to download and install external code if dependencies are missing.
Evidence: In SKILL.md (Operating Rule 4), the agent is instructed to offer the command npx skills add wondelai/skills/<slug> --global to the user. This points to an external repository for code installation.

create-app