The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from user requests and external web research to generate Product Requirement Plans (PRPs) that include executable shell commands, creating a potential path for data-driven attacks.
Ingestion points: The skill reads user-provided feature requests and instructs the agent to perform external research via web search (specified in SKILL.md and references/research_methodology.md).
Boundary markers: There are no instructions for using delimiters or specific 'ignore embedded instructions' warnings when the agent incorporates external research findings into the generated PRP content.
Capability inventory: The skill requires the agent to write files to the local filesystem (the PRPs/ directory) and generates shell commands (e.g., npm run build and npm run test) intended for post-implementation validation (SKILL.md, assets/prp_template.md).
Sanitization: The workflow lacks explicit steps or guidance to sanitize, filter, or validate content retrieved from external URLs before it is interpolated into the generated implementation steps and validation gates, which could allow malicious instructions in research data to influence the resulting plan.

prp-generator