The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from user prompts and referenced artifacts such as seed.md and decisions.md to generate a markdown proposal. It lacks explicit boundary markers or sanitization for this external content, creating an indirect prompt injection surface where malicious instructions in the input could influence the agent's behavior during the generation process.
Ingestion points: Reads from seed.md, decisions.md, and arbitrary user-provided inputs/artifacts.
Boundary markers: No explicit delimiters or instructions to the model to ignore embedded commands within the input data are defined in the procedure.
Capability inventory: Performs file-write operations to docs/threads/<thread>/proposal.md and can invoke /emit-pending-decisions.
Sanitization: No evidence of escaping, validation, or filtering of the ingested external content before it is processed.
[COMMAND_EXECUTION]: The skill performs file system operations, specifically writing or revising the proposal.md file within the docs/threads/ directory structure based on model-generated content.

propose