The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository to define its operational logic and behavior.
Ingestion points: Reads CONTEXT.md, CONSTITUTION.md, CONTEXT-MAP.md, and all files under docs/adr/ and src/ as primary sources of instruction and domain knowledge.
Boundary markers: The skill lacks explicit boundary markers or delimiters when interpolating data from these files into its reasoning process.
Capability inventory: The skill can perform file-write operations to handoff.md, plans/, and docs/adr/, and it can invoke subagents or external tools like /work-prototype, /work-implement, and the canvas skill.
Sanitization: No sanitization or validation of the content read from these repository files is performed before it is used to drive agent actions or update other files.
[PROMPT_INJECTION]: The skill includes instructions that treat CONSTITUTION.md as 'binding law' that can override other directions. While intended for project governance, this pattern could be abused if a malicious actor places injection attacks within the constitution file to hijack agent behavior.

work-discover