The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes a wide variety of untrusted project-local files, which constitutes a surface for indirect prompt injection attacks if those files contain malicious instructions.
Ingestion points: The skill reads from design/gdd/*.md, docs/architecture/adr-*.md, production/epics/**/*.md, Assets/Tests/**/*.cs, and various engine reference documents.
Boundary markers: There are no explicit instructions for the agent to use XML-style tags, delimiters, or specific escaping when processing or interpolating the content of these external files.
Capability inventory: The skill utilizes Write permissions to generate architecture reports, update the requirement registry (tr-registry.yaml), and maintain session state (active.md). It also has the capability to spawn sub-agents (unity-specialist) via the Task tool.
Sanitization: The instructions do not define any sanitization, filtering, or validation logic for the content extracted from the design and architecture documents.

architecture-review