The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from the repository to generate new stories.
Ingestion points: The agent is instructed to read docs/prd.md, docs/stories/*.md, docs/specs/, and docs/decisions/ to determine the next tasks and technical context (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or warnings to treat the ingested documentation content as untrusted data, which could allow malicious instructions embedded in a PRD to influence the agent's output.
Capability inventory: The agent has the capability to write new documentation files to the docs/stories/ directory (SKILL.md).
Sanitization: The skill does not provide mechanisms to sanitize, validate, or escape the content read from external documentation before it is processed by the model.

create-story