The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources such as issue trackers and PLAN.md files, which are controlled by users or potential attackers.
Ingestion points: In SKILL.md, the agent is instructed to read the issue's title and body, PLAN.md, and CONTEXT.md to determine implementation steps.
Capability inventory: The skill possesses the capability to modify repository code and execute test suites via the /tdd command.
Boundary markers: The instructions do not define specific delimiters to separate untrusted issue content from the agent's system instructions.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from the issue tracker or plan files before it influences code generation.
Mitigation: The skill explicitly instructs the agent to leave changes uncommitted and requires the user to perform a manual diff review and trigger a separate /commit skill, providing a human-in-the-loop safeguard.

implement-change