The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing potentially untrusted data from the repository to update agent configurations and templates.
Ingestion points: The skill reads from user inputs and repository context files, specifically README.md, docs/quickstart.md, and existing constitution versions.
Boundary markers: The workflow relies on [ALL_CAPS_IDENTIFIER] placeholders for template substitution but lacks explicit delimiters or instructions to the model to ignore adversarial commands embedded in the ingested text.
Capability inventory: The skill performs broad file-system writes, updating files in .github/agents/, .claude/commands/, and other skills/ directories, which could be leveraged if the agent is manipulated by injected content.
Sanitization: There is no evidence of sanitization or validation of the data retrieved from repository documentation before it is written back into executable prompt files.

speckit-constitution