The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where instructions embedded in project files could influence the agent's behavior during design and task planning.
Ingestion points: The skill reads untrusted input from requirements.md (Step 4) and scans the repository source code (Step 1) to build a digest of the system's surface.
Boundary markers: The instructions designate requirements.md as the 'input contract' but do not specify the use of delimiters or warnings to ignore potential embedded instructions in the requirements. It does implement a manual review boundary in Step 4 via an independent 'review subagent'.
Capability inventory: The skill is capable of writing files to the local repository (specifically docs/specs/ and the .skills/ directory) and invoking sub-skills such as plan-tasks and load-subgraph to guide further agent actions.
Sanitization: No explicit logic or instructions are provided for sanitizing or escaping content from ingested requirement files or source code before it is incorporated into the generated design documents or sub-skill prompts.

design-solution