The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted data from the local environment and user input.
Ingestion points: The skill reads project code, documentation, constraints, and recent commits (SKILL.md, Step 1). It also receives user input via chat and the AskUserQuestion tool.
Boundary markers: There are no instructions to wrap or delimit the ingested project content with security markers (e.g., 'ignore embedded instructions' tags).
Capability inventory: The skill has the capability to write files to the project directory (docs/brainstorms/), perform git commit operations, and dispatch subagents for review tasks.
Sanitization: The instructions do not specify any sanitization or escaping of the content read from the codebase before it is processed by the agent.
[COMMAND_EXECUTION]: The skill performs shell-level operations as part of its documented workflow.
Evidence: The agent is instructed to use git for committing design documents to the repository (SKILL.md Step 6 and references/design-and-handoff.md). It also interacts with other development skills such as ia-planning.

brainstorming