The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingest data from various files in the repository which could be modified by third parties to include malicious instructions.
Ingestion points: Milestone definitions in production/milestones/, sprint reports in production/sprints/, the risk register in production/risk-register/, and codebase markers like TODO, FIXME, and HACK found via grep (referenced in references/claude-skill.md).
Boundary markers: Absent. The instructions do not define clear delimiters or "ignore previous instructions" constraints when processing the ingested project data.
Capability inventory: The skill is authorized to use Write for file modifications, Task for spawning a "producer" sub-agent, and AskUserQuestion to interact with the user (referenced in references/claude-skill.md).
Sanitization: Absent. There is no evidence of sanitization or escaping of the repository-sourced content before it is processed or passed to other tools and agents.

milestone-review