The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from the local file system to drive its logic.
Ingestion points: The skill reads content from seed.md, decisions.md, and proposal.md located in the docs/threads/ directory (Step 2).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these files as untrusted or to ignore any instructions embedded within them.
Capability inventory: The skill can edit the proposal.md file (Step 4) and invoke the /emit-pending-decisions tool (Step 6).
Sanitization: No evidence of sanitization, filtering, or validation of the input file content was found before processing.

reconcile-proposal