The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from multiple external-facing project files and passes the aggregated content to sub-agents via the Task tool, creating a surface for indirect prompt injection.
Ingestion points: Reads content from user-provided story paths, docs/architecture/tr-registry.yaml, architectural decision records (ADRs), docs/architecture/control-manifest.md, and dependency stories in production/epics/**/*.md.
Boundary markers: The skill provides full content to sub-agents without specifying the use of robust delimiters or 'ignore embedded instructions' warnings to separate the instructions from the potentially untrusted file data.
Capability inventory: The orchestrator and its spawned sub-agents have access to Bash, Write, and Task tools, allowing for significant file system and command-line operations.
Sanitization: No sanitization, escaping, or validation logic is defined for the content extracted from the various project files before it is interpolated into the context package for the programmer agents.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash and Task tools to navigate the file system, read project metadata, and execute sub-agents. While these are used for the skill's primary development purpose, the high level of autonomy in routing and implementing code based on file-driven context increases the risk if the input files are compromised.

dev-story