The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data and has the capability to perform sensitive operations.
Ingestion points: The skill reads bug descriptions, screenshots, and accessibility nodes from /ios-qa findings in SKILL.md (Phase 1).
Boundary markers: There are no explicit delimiters or instructions provided to separate the untrusted bug data from the agent's core instructions.
Capability inventory: The skill uses the Bash tool to run xcodebuild, the Edit tool to modify Swift source code, and the Write tool to create regression test fixtures in SKILL.md (Phases 3 and 5). It also executes several local binary scripts for session management.
Sanitization: The skill does not describe any sanitization or validation processes for the ingested bug findings.
[COMMAND_EXECUTION]: The skill executes several local scripts and build commands as part of its normal operation.
Evidence: The preamble in SKILL.md and sections/preamble.md executes gstack-skill-start, gstack-question-preference, gstack-skill-end, and gstack-context-recovery from the local ~/.claude/skills/gstack/bin/ directory.
Evidence: Phase 3 in SKILL.md executes xcodebuild via the Bash tool to build and install the application on a target iOS device.

ios-fix