The Agent Skills Directory

[PROMPT_INJECTION]: The skill mandates an 'Autonomous Execution Policy' that instructs the agent to 'NEVER pause, stop, or wait for user input during execution.' This directive overrides standard safety protocols where an agent would normally request confirmation before proceeding with automated tasks.
[DATA_EXFILTRATION]: The instructions require the agent to read MCP configuration files (e.g., .mcp.json, .vscode/mcp.json, opencode.json) to perform server discovery. Accessing these files is a security risk as they frequently store sensitive data like API keys, tokens, and internal endpoint configurations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon content from external files such as prd.md, techspec.md, and tasks.md. This creates an attack surface where malicious instructions embedded in these documents could influence the agent's behavior.
Ingestion points: Documentation analysis in Step 1 reads ./prds/prd-[feature-slug]/prd.md, techspec.md, and tasks.md.
Boundary markers: There are no explicit markers or instructions to treat content in these files as data rather than instructions.
Capability inventory: The agent can execute shell commands for service management, perform file system operations, and invoke various MCP tools.
Sanitization: No sanitization of the documentation content is performed prior to processing.
[COMMAND_EXECUTION]: The skill executes shell commands to start development servers based on configurations found in project-specific reference files. This facilitates the execution of arbitrary code defined within the repository structure.
[DYNAMIC_EXECUTION]: The agent uses specialized MCP tools to evaluate JavaScript within a browser context to manipulate application state. Executing dynamically generated scripts in the UI layer poses a risk if those scripts are influenced by untrusted external inputs.

do-execute-qa