The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data (user conversation logs, planning outputs, and 'grilling' session results) to generate its briefs. If this input contains malicious instructions, they could influence the generated brief's content or the agent's behavior during the packaging process.
Ingestion points: Input conversation history, multi-component planning outputs, and grilling output (as specified in the 'Process' section of SKILL.md).
Boundary markers: The skill does not define explicit delimiters for input data, relying on general context to distinguish instructions from source material.
Capability inventory: The skill uses the Write tool to create new brief files and uses Grep and Glob for discovery.
Sanitization: While the instructions mandate stripping specific identifiers like file paths and line numbers, they do not include generalized sanitization for adversarial prompt injection in the source text.
[METADATA_POISONING]: The skill's manifest in SKILL.md declares ownership of files matching briefs/**/*.md, but the instructions within the 'Process' and 'Out-of-Scope as Concept Files' sections direct the agent to write concept files to an out-of-scope/ directory. This discrepancy between the declared ownership metadata and the actual file-writing behavior is a manifest inconsistency that could lead to unexpected behavior in platforms with strict ownership enforcement.

work-item-brief