The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and act upon instructions found in external files such as tasks.md and the .specify/ directory.
Ingestion points: Reads task definitions and project specifications from tasks.md, agent_data/tasks/, and the .specify/ folder.
Boundary markers: Absent. The instructions do not define any delimiters or specific guidance for the agent to distinguish between its own logic and instructions embedded within the data files.
Capability inventory: The skill is explicitly authorized to execute shell commands, perform file system edits, and use the agent-utilities-kg MCP tool suite (including kg_ingest).
Sanitization: Absent. There is no mechanism described to validate or sanitize the content of the task files before the agent processes them as executable instructions.
[COMMAND_EXECUTION]: Arbitrary Command Execution Surface. The skill's 'Execution Logic' includes the instruction to 'Perform the required file edits or commands' based on the state of the task registry. If an attacker can modify the tasks.md or the underlying JSON state, they could potentially trick the agent into executing malicious commands.

sdd-implementer