The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions direct the agent to "ask nothing" and bypass mid-run check-ins or questions during serial task implementation. This design choice explicitly overrides standard interactive behavior and reduces user oversight of the agent's automated actions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes task definitions, specifications, and architecture decision records from the local repository as primary input for its implementation logic. These files are processed without boundary markers or sanitization, making the agent vulnerable to instructions embedded within the documentation.\n
Ingestion points: The agent reads task files in docs/monorail/<feature>/tasks/, spec.md, CONTEXT.md, and ADR files under docs/monorail/adr/.\n
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing logic.\n
Capability inventory: The skill has the ability to modify the file system (updating task status), execute shell commands (ls, git worktree, git commit), and invoke test runners.\n
Sanitization: There is no evidence of filtering or escaping logic applied to the content read from the repository files before it is used to drive agent behavior.\n- [COMMAND_EXECUTION]: The skill performs shell-based operations including directory listing and complex git operations like worktree management and commits. These actions are performed automatically during sequential builds, which could be exploited if the inputs (task names or file paths) are manipulated via indirect injection.

rail-build