The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting untrusted data from repository configuration and project specification files.
Ingestion points: The skill reads repository-local sources including package.json, pyproject.toml, go.mod, Cargo.toml, Makefile, justfile, CI/workflow files, and README* to derive execution commands. It also reads requirements.md, design.md, and tasks.md to construct prompts for sub-agents.
Boundary markers: The skill does not implement delimiters or explicit 'ignore' instructions when processing data from these external files.
Capability inventory: The agent has the capability to execute shell commands (via derived test/build/smoke commands) and write to the file system (during TDD implementation and git commits).
Sanitization: No sanitization or validation logic is applied to the commands or content extracted from the repository files before execution or interpolation into sub-agent prompts.
[COMMAND_EXECUTION]: The skill intentionally executes shell commands to automate the software development lifecycle. These commands are dynamically sourced from the repository's own configuration, creating a mechanism for code execution that is dependent on the integrity of the repository files.

kiro-impl