The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts (e.g., python3 scripts/feature_ideate.py "<app>") using user-provided input for the <app> variable. This creates a potential command injection vector if the agent platform does not properly sanitize or escape the input before passing it to the shell.
[PROMPT_INJECTION]: The workflow is vulnerable to indirect prompt injection because it ingests and processes untrusted data in the form of raw user reviews from the App Store.
Ingestion points: Raw app review content is loaded from data/apps_full.json via the feature_ideate.py script and then processed by the LLM.
Boundary markers: The instructions lack delimiters or explicit "ignore embedded instructions" directives to prevent the LLM from obeying malicious prompts hidden within user reviews.
Capability inventory: The skill can execute shell scripts and write results to the local filesystem (data/feature_ideas_<slug>.md).
Sanitization: There is no evidence of sanitization or filtering of the review text (e.g., removing control characters or markdown injections) before it is analyzed by the LLM.

feature-ideation