The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project specifications and task lists that may contain untrusted data. This creates a surface for indirect prompt injection, where malicious instructions embedded in a specification could attempt to subvert the reviewer models' mandates.
Ingestion points: The skill reads functional specifications, technical plans, and generated tasks from the docs/specs/ and tasks/ directories (SKILL.md, Phase 1 & 3).
Boundary markers: The skill employs clear system prompts to define a 'hostile' role and enforces a strict JSON-only output contract to reduce the influence of embedded instructions. Each reviewer operates in an isolated session (--no-session).
Capability inventory: The reviewer models are provided with read-only tools: read, grep, find, and ls (scripts/run-panel.sh).
Sanitization: The skill relies on the adversarial framing and specific personas to handle potentially malicious content within the reviewed documents rather than pre-processing the text.
[COMMAND_EXECUTION]: The skill utilizes local scripts to orchestrate the model panel and process the resulting data.
Evidence: The workflow involves running a Bash script (scripts/run-panel.sh) which invokes the pi CLI tool, and a Node.js script (scripts/extract-json.mjs) to parse raw model transcripts.
Context: These executions are standard for the skill's stated purpose of parallelizing reviews and managing transcript processing.

specs-kit-adversarial-review