The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external Markdown files (PROPOSAL.md) and maintain a discussion log (MESSAGES.md) that records human feedback verbatim. This creates a surface for indirect prompt injection where malicious instructions embedded in a proposal or a review comment could attempt to override the agent's behavior during the review cycle.
Ingestion points: The skill reads PROPOSAL.md files, human comments in MESSAGES.md, and general "repository evidence" to validate design claims.
Boundary markers: While the skill uses YAML front matter for metadata, the primary content of the proposals and message logs does not use strict isolation or sanitization delimiters to distinguish data from instructions.
Capability inventory: The agent has the ability to execute the proposals CLI tool, write to the filesystem (specifically the .agents/paperwork/proposals directory), and manage a tracking database (tracker.db).
Sanitization: The instructions do not specify any sanitization, filtering, or validation logic for the content ingested from external Markdown files or human messages before they are processed by the LLM or passed to CLI tools.
[COMMAND_EXECUTION]: The skill relies on a CLI tool named proposals to handle the lifecycle of design documents. Subcommands such as proposals new <tag> <title> <component> and proposals submit <tag> <path/to/PROPOSAL.md> utilize user-defined tags and file paths. If these parameters are derived from untrusted input without sufficient platform-level validation, they could serve as a vector for command injection arguments.

propose