The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from project plans and system configuration files, which is then passed as context to parallel reviewer agents. This creates a potential vulnerability where malicious instructions embedded in a plan could influence the reviewer's output or decisions.\n
Ingestion points: Plan content is extracted from the conversation history, user-provided text, or specific files located in docs/arc/plans/ and docs/plans/. Project configuration is read from package.json, requirements.txt, and pyproject.toml.\n
Boundary markers: The process instructions do not specify the use of delimiters (such as XML tags or unique markers) or system-level constraints to prevent sub-agents from obeying instructions contained within the plans being reviewed.\n
Capability inventory: The skill uses Glob and Grep for file discovery and analysis, spawns parallel LLM processes via the Task command, and is authorized to update plan files with the resulting decisions.\n
Sanitization: No sanitization or validation logic is defined to filter out potentially malicious natural language instructions from the external plan data before it is interpolated into agent prompts.

review