The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes untrusted content from multiple project files to drive its logic and output.
Ingestion points: The skill reads data from EPIC.md, GDD files in design/gdd/, ADR files in docs/architecture/, control-manifest.md, tr-registry.yaml, and qa-plan-*.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these files as untrusted or to ignore any instructions embedded within them.
Capability inventory: The skill uses the Write tool to create new specification files, the Task tool to spawn sub-agents (qa-lead), and the mcp__backlog__task_create tool to interact with an external project management system.
Sanitization: The skill does not perform any escaping, filtering, or validation of the ingested text before interpolating it into story files or task metadata.

create-stories