The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external software specifications, repository code, and Git metadata, which creates a potential surface for indirect prompt injection attacks.
Ingestion points: The instructions in SKILL.md direct the agent to read the "complete current spec," "linked parts," "repository instructions," "relevant research," and "checkout, revision, Git status, staged and unstaged diffs."
Boundary markers: The instructions do not specify the use of delimiters or provide warnings to the agent to ignore or isolate instructions that may be contained within the external materials being reviewed.
Capability inventory: The skill utilizes the agent's standard capabilities for reading local files and executing Git commands. It also suggests using "focused, safe execution" to verify material facts.
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content of the files it reads before incorporating that information into its reasoning process.

spec-review