The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) due to its processing of untrusted external data within an agentic loop.
Ingestion points: The skill ingests untrusted data from user-provided design topics (SKILL.md), web research results (internal/tool-discovery.md), and codebase scans (agent-modes/enhancement.md).
Boundary markers: There are no explicit boundary markers or sanitization logic to delimit untrusted content before it is processed by the LLM.
Capability inventory: The skill has access to powerful tools including 'Bash', 'Write', and 'Edit'.
Sanitization: There is no evidence of escaping or filtering logic for external content interpolated into design prompts.
[COMMAND_EXECUTION]: The skill uses the 'Bash' tool to execute shell commands for version control and environment management.
Evidence: It executes git fetch and git rev-list to check repository status (SKILL.md) and uses the npx skills CLI to find and install agent extensions (internal/tool-discovery.md).
[EXTERNAL_DOWNLOADS]: The skill performs network operations to research technology landscapes and install dependencies.
Evidence: It spawns a 'researcher' subagent to fetch data from the web for tool discovery and landscape analysis. It also performs remote installations using npx skills add <owner>/<repo> -y, which downloads code from external repositories. These actions are gated by user confirmation prompts.

architect