The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external web sources and local codebase files to generate workflow documents such as PRDs, TDDs, and implementation outlines. This creates a potential vector for indirect prompt injection where malicious content could influence the agent's implementation logic. Ingestion points: Web documentation (via web-search-researcher) and codebase files (via codebase-analyzer). Boundary markers: None explicitly defined. Capability inventory: The agent uses high-capability tools including Bash, Write, and Edit. Sanitization: No explicit sanitization of ingested content is performed before synthesis.
[COMMAND_EXECUTION]: The skill's implementation subagent is instructed to execute shell commands specified in the Validation sections of generated implementation outlines. While intended for legitimate development tasks like running tests, this allows for the execution of arbitrary commands derived from the agent's research phase.
[EXTERNAL_DOWNLOADS]: The research subagent uses shell tools (curl via bash) to fetch documentation from external URLs. Although focused on development-related files like llms.txt, this involves network operations to retrieve remote content outside of scoped web fetch tools.

rpi