The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, potentially untrusted data from task-specific directories (e.g., tickets, research docs, and project context). This creates a surface for indirect prompt injection where malicious instructions embedded in these external files could influence the agent's behavior.
Ingestion points: The skill reads all relevant files in .humanlayer/tasks/TASKNAME during the 'understand-the-context' step.
Boundary markers: While the instructions encourage the agent to cite inputs (e.g., "Per the ticket..."), there are no strict structural delimiters or sanitization protocols enforced for the ingested content.
Capability inventory: The skill has access to file system operations (ls, Read, Write), artifact creation (Markdown and HTML mockups), and can spawn other analysis agents (codebase-analyzer, etc.).
Sanitization: No explicit sanitization or filtering of external input is implemented.
[COMMAND_EXECUTION]: The skill uses the ls -La command to locate task directories and verify symlinks, which is a standard file management operation for the agent's workflow.
[DATA_EXFILTRATION]: The skill references 'cloud permalinks' for sharing generated artifacts with teammates. This indicates that the content produced (PRDs and mockups) is uploaded to an external web service, which is a core feature for artifact persistence and distribution within the platform.

create-prd