The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill involves a surface for indirect prompt injection because it is designed to ingest and act upon data from external files that may be manipulated.
Ingestion points: The controller reads tasks.md and implementation-notes.md to guide execution, as described in SKILL.md. Subagents are instructed to read task-N-brief.md and task-N-report.md as part of their requirements and review process.
Boundary markers: Prompt templates in implementer-prompt.md and task-reviewer-prompt.md use Markdown headers to separate instructions from untrusted data, although they do not explicitly include "ignore embedded instructions" warnings for the processed files.
Capability inventory: The skill executes shell commands (e.g., git, npm, npx playwright) and manages subagent dispatches based on the content of these files.
Sanitization: The skill does not describe specific sanitization or escaping mechanisms for the text contained within the ingested reports or plans.
[COMMAND_EXECUTION]: The skill uses standard CLI tools to manage the development environment and verify code changes.
It utilizes git worktree commands to create isolated environments for parallel task implementation.
It employs npx playwright screenshot to capture visual evidence of UI changes, which is a well-known service provided by Microsoft for automated testing.

build-in-waves