The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read CONTEXT.md to inform the creation of prototypes, which introduces a potential vector for instructions hidden in data to influence the subagent's code generation.
Ingestion points: Reads CONTEXT.md from the local repository environment.
Boundary markers: Absent; there are no instructions to the subagent to treat the context data as untrusted or to ignore embedded commands.
Capability inventory: The subagent can write files and generate commands intended for local execution.
Sanitization: No sanitization or validation of the context file content is performed before it is passed to the builder subagent.
[EXTERNAL_DOWNLOADS]: The instructions explicitly tell the agent to invoke an external skill from the mattpocock/skills repository. This creates a dependency on a third-party codebase that is not managed by a verified trusted vendor.
[COMMAND_EXECUTION]: The skill workflow concludes by providing a command for the human to run to execute the prototype. Because this command is generated by a subagent that may be influenced by external context (like CONTEXT.md), there is a surface for command injection if the subagent is successfully manipulated.

work-prototype