The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from user requests and product state (code/behavior) as part of its primary workflow.\n
Ingestion points: Step 1 in SKILL.md instructs the agent to 'Find the intent' from the user and 'Examine how the product behaves now,' which involves reading potentially untrusted user input and existing product source code.\n
Boundary markers: Absent. The instructions do not define specific delimiters or warnings to disregard instructions found within the data being analyzed.\n
Capability inventory: The skill delegates operations to other tools (specifically ship and prove mentioned in the Mechanics section), which likely possess capabilities to modify code, write to the filesystem, and verify flows including sensitive data like payments.\n
Sanitization: Absent. There are no instructions to sanitize or validate the content of the product state or user requests before processing.\n
Mitigation: The skill includes robust human-in-the-loop requirements in Step 3 and the 'Rules' section, mandating user agreement and explicit approval before any changes to real data or users are implemented.

product-manager