The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as PRDs, tickets, and code files, as part of its quality review process. This creates a surface for indirect prompt injection if the processed files contain instructions designed to manipulate the reviewer agent's behavior.
Ingestion points: SKILL.md specifies reading "The work" (file paths, saved pages, screenshots) and "The point of view" (PRODUCT.md, PRD, or tickets) into the agent's context.
Boundary markers: The skill provides a strict template and instructions for the sub-agent to "Return only the crit sheet, in the exact format from crit-sheet.md." Additionally, SKILL.md includes an explicit security warning to never paste returned text directly into a shell command.
Capability inventory: The reviewer sub-agent is explicitly configured to be read-only with no shell or network access. The main agent executes a local validation script (check_crit.py) which performs text analysis only.
Sanitization: The scripts/check_crit.py tool validates the output format using regular expressions, ensuring the response adheres to the expected structure before it is presented to the user.
[COMMAND_EXECUTION]: The skill involves the execution of a local Python script to validate the results of the sub-agent's review.
Evidence: SKILL.md contains instructions to execute python3 <skill-dir>/scripts/check_crit.py <scratch-dir>/crit-sheet.md.
Evidence: The test file scripts/test_check_crit.py uses subprocess.run to invoke the check_crit.py script for verification. This is a standard testing practice and involves only local, known code.

editor-pass