The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external data from the local repository (specifically align.md, map.md, and codebase search results) to generate new specification documents. This creates a surface where malicious instructions embedded in those files could influence the agent's behavior.
Ingestion points: Content is read from docs/monorail/align.md, docs/monorail/map.md, and general files via grep and read tools.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided to the agent to isolate the ingested data.
Capability inventory: The skill can execute shell commands (ls, grep, read), write to the local file system (spec.md), and spawn sub-agents.
Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from the codebase.
[COMMAND_EXECUTION]: The skill directs the agent to perform directory listings and file reads using a feature slug that may be provided by the user. The prompt lacks instructions to validate this identifier, which could be leveraged for path traversal or command injection if the underlying tool execution environment is not sufficiently hardened.
[DYNAMIC_EXECUTION]: The skill includes instructions to offload codebase exploration to multiple sub-agents at runtime. While the instructions specify these agents should be read-only, this represents the dynamic orchestration of agent resources based on the input context.

rail-spec