The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources including story files, requirements (TR registry), and Architecture Decision Records (ADR). Maliciously crafted content within these documents, such as instructions hidden in 'Acceptance Criteria' or 'Implementation Notes', could potentially influence the behavior of the programmer agents utilized by the skill.
Ingestion points: Reads story files from paths provided in arguments or session state, as well as docs/architecture/tr-registry.yaml and ADR files in docs/architecture/.
Boundary markers: The skill does not explicitly instruct the agent to use delimiters or 'ignore embedded instructions' markers when processing the content of these story or ADR files.
Capability inventory: The skill has broad access to the Write tool (for modifying project Assets/ and Packages/), the Bash tool (for executing verification commands), and the Agent tool (to delegate tasks to sub-agents).
Sanitization: No explicit sanitization or validation mechanisms are described for the content of the ingested documents.
[COMMAND_EXECUTION]: The workflow relies on the Bash tool to execute tests and verification scripts (e.g., unity-test-verifier). While standard for development workflows, this execution capability represents a risk if an attacker successfully injects malicious instructions through the ingested documentation.

dev-story