The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied implementation plans or descriptions to generate structured agent sprints. This creates a surface for indirect prompt injection where malicious instructions embedded in the input plan could influence the agent's behavior during the decomposition or subsequent execution phases.
Ingestion points: Untrusted data enters the agent context through the argument path or user-provided description in SKILL.md (Workflow Step 1).
Boundary markers: The instructions do not define specific delimiters or warnings to separate user-provided plan content from the agent's core instructions.
Capability inventory: The generated sprint definitions include instructions for shell command execution (e.g., dotnet build, git operations, and verification commands) and filesystem state changes, as seen in references/execution-protocol.md and assets/sprint-template.yaml.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external plan content before it is processed or interpolated into the output.

sprint-planner