The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process untrusted external data sources such as project tickets, PRDs, and research documents to generate specifications.
Ingestion points: The skill instructions state to "turn a ticket, intake note, PRD, audit, or research doc into one [spec]" (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following malicious instructions that might be embedded in the source material.
Capability inventory: The skill allows for local file writes to ~/.agents/artifacts/, codebase read access, and execution of the suspec validation tool (SKILL.md).
Sanitization: No sanitization or filtering logic is specified for the input data derived from external sources.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a local command-line tool for specification verification.
Evidence: "When the deterministic checker is available, run suspec check <path>" (SKILL.md).
[DATA_EXFILTRATION]: The skill involves reading project documentation and writing resulting artifacts to the user's home directory.
Read surface: Rule 5 instructs the agent to "Read what the codebase, its ADRs, and its open issues already have" (SKILL.md).
Write surface: The skill directs the agent to "Place the file under ~/.agents/artifacts/<workspace>/" (SKILL.md).

write-spec