The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its reliance on external data sources to define its tasks and implementation steps.
Ingestion points: The workflow reads task assignments and instructions from CLI arguments ($arguments.message) and local message files located in .claude/session/pending-messages-developer.json and .claude/session/messages/developer/*.json as defined in SKILL.md.
Boundary markers: There are no specified delimiters or instructions to treat data from these external files as untrusted or to ignore any embedded agent instructions within them.
Capability inventory: The skill possesses significant capabilities, including the ability to read and write project source code, modify PRDs (Product Requirements Documents), update task state files, use network-based research tools (WebSearch, Fetch), and invoke other subagents/skills like code-refactor.
Sanitization: The instructions lack any sanitization or validation steps for the task data before it is parsed and acted upon by the agent during the planning and implementation phases.

developer-workflow