The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external issue trackers (such as GitHub, Jira, or Linear) and local repository code to generate planning artifacts.
Ingestion points: Reads data from issue URLs, repository files, and user-supplied requirements text as described in references/source-and-discovery.md.
Boundary markers: The process uses structured Markdown identifiers (R1, D1, T1) and formal review gates. However, it lacks explicit instructions for the agent to ignore malicious instructions that might be embedded within the external source data.
Capability inventory: The skill can execute CLI tools (plannotator), compute file hashes, and write files to the local filesystem, as specified in references/approval-stage.md.
Sanitization: No specific sanitization or filtering of the input source data is mentioned beyond classifying facts and decisions.
[COMMAND_EXECUTION]: The skill performs shell command execution for validation and integrity checking.
Tool usage: It attempts to run the plannotator CLI tool with arguments annotate <artifact> --gate --json during the review process in references/approval-stage.md.
Integrity checks: It uses system utilities or language libraries to compute SHA-256 hashes of generated artifacts to certify their state.
[SAFE]: The skill includes explicit security boundaries, such as the 'Planning boundary' defined in SKILL.md, which prohibits modification of application code, tests, configuration, or branches, limiting the agent's impact to a specific documentation directory.

spec