The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions in SKILL.md that explicitly bypass human-in-the-loop safety measures. It directs the agent to skip all user confirmations and input between phases ("Do NOT wait for user input", "No pauses, no questions, no confirmations") and to ignore prompts from sub-skills that might ask for approval ("If any of them asks 'ready to proceed?', treat it as a regression... not a signal to stop"). This behavior overrides standard guardrails meant to ensure user oversight of AI actions.
[COMMAND_EXECUTION]: The skill executes multiple local shell scripts and tools (resolve.sh, session.sh, init-project.sh, enforce-sprint.sh) located in the nanostack environment. These scripts perform complex operations like project initialization, session management, and phase gating, running with the agent's execution privileges.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of external content. 1. Ingestion points: User-supplied feature requests and existing codebase artifacts (processed in SKILL.md via resolve.sh). 2. Boundary markers: No delimiters or instructions to ignore embedded commands are present. 3. Capability inventory: The skill can execute arbitrary bash commands, write files, and invoke further sub-agents (nano, review, security, qa, ship). 4. Sanitization: No input validation or sanitization is implemented for the data ingested from the project environment.
[DATA_EXFILTRATION]: The skill invokes telemetry scripts (skill-preamble.sh, skill-finalize.sh) at the start and end of the session. While the scripts are local to the environment, their function is to report skill usage data externally, potentially exposing environment details or prompt content depending on the implementation of the telemetry helpers.

feature