The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from repository files which could contain malicious instructions.
Ingestion points: The skill reads task contracts from production/tasks/<TASK-ID>/contract.md, smoke reports from production/qa/smoke-*.md, and GDD acceptance criteria in references/claude-skill.md (Phases 1, 2, and 4).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided when passing ingested content to subagents like qa-lead and qa-tester.
Capability inventory: The skill utilizes Read, Write, Task (for subagent spawning), and Skill (to invoke other workflows such as bug-report).
Sanitization: There is no evidence of sanitization, escaping, or validation of the external project content before interpolation into prompts.

team-qa