The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill incorporates a workflow that involves reading and processing external, potentially untrusted documents which creates a surface for indirect prompt injection.
Ingestion points: The agent is instructed in SKILL.md (Phase 1) to review Product Requirement Documents (PRDs), requirements, and existing system context using tools like Read, Grep, or Glob.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the content being read, which increases the likelihood of the agent following malicious instructions embedded in a PRD.
Capability inventory: The skill has the Bash tool in its allowed-tools list, providing the agent with the ability to execute shell commands, modify files, and perform network operations based on instructions it may encounter in data.
Sanitization: There are no defined sanitization, escaping, or filtering steps for the ingested content before it is processed by the agent.

architect