The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from potentially untrusted external sources, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: SKILL.md instructs the agent to "Read the relevant issue, comments, linked decisions" and "Search available Slack or Notion context" to gather product requirements.
Boundary markers: The instructions lack specific guidance on using delimiters or instruction-ignoring prompts when processing this external content.
Capability inventory: The skill has the authority to execute "repository-native repro, experiment, or research step" and performs file modifications to FEATURE-CONTRACT.md.
Sanitization: There is no mention of sanitizing, escaping, or validating content retrieved from these external sources before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill allows for the execution of code within the repository to resolve uncertainties.
Evidence: SKILL.md prompts the agent to "name the exact uncertainty and the smallest useful repository-native repro, experiment, or research step. Run it only within existing authority." While limited to existing authority, executing scripts found in the repository that may have been influenced by external requirements (like issues or comments) carries inherent risk.

feature-grill