The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the processing of untrusted source documents.
Ingestion points: The skill reads raw document content or local file paths provided by users to extract goals and constraints (SKILL.md, Section 1).
Boundary markers: No specific delimiters or instructions to disregard embedded commands within the source document are implemented.
Capability inventory: The skill possesses the ability to write multiple files to the local file system and execute subprocess commands via the agent-team CLI (SKILL.md, Sections 5 and 7).
Sanitization: There is no evidence of sanitization or validation for the content derived from source documents before it is used in file names or CLI parameters.
[COMMAND_EXECUTION]: The skill executes a local CLI tool using arguments derived from external, untrusted source documents.
Evidence: The command agent-team task create --role <role> "<title>" --design "<task-file>" is constructed using variables <role> and <title> extracted from the intake document.
Context: While the mandatory human confirmation step in Step 6 provides a significant mitigation, the underlying vulnerability for argument injection remains if the user does not carefully review the drafted tasks for malicious payloads.

task-splitting