The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests project source code and tests to verify task completion.
Ingestion points: The agent reads existing project files, test results, and artifacts in sdd-specs/ during the implementation and convergence phases (SKILL.md, references/tasks-template.md).
Boundary markers: The instructions do not specify explicit delimiters or "ignore" instructions for external content, relying instead on the host agent's native safety filters.
Capability inventory: The skill is capable of executing shell commands for tests, linters, and static analysis, as well as writing to the project filesystem (SKILL.md).
Sanitization: No explicit sanitization or filtering of external code content is defined in the workflow.
[SAFE]: The skill operates entirely within the local environment, creating and managing artifacts under a dedicated sdd-specs/ directory.
[SAFE]: The instructions explicitly state that the host agent's safety rules and user permissions take precedence, and implementation tasks require separate user authorization before execution.
[SAFE]: Workflow state management utilizes standard local tools like git hash-object to ensure integrity and detect external modifications to spec artifacts.
[SAFE]: No evidence of prompt injection, data exfiltration, or malicious obfuscation was found in the instructions or templates.

sdd-workflow