The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes implementation plans that could originate from untrusted sources like public issue reports or third-party documentation.
Ingestion points: SKILL.md extracts task descriptions from plan files, which are then interpolated directly into subagent prompts in implementer-prompt.md and spec-reviewer-prompt.md.
Boundary markers: The skill lacks explicit delimiters or instructions to subagents to treat external task text strictly as data, increasing the risk that embedded instructions could be executed.
Capability inventory: Subagents are granted broad capabilities including filesystem modification, git commits, and arbitrary code execution via testing frameworks.
Sanitization: There is no mechanism described to sanitize or validate the content of implementation plans before they are passed to subagents.
[COMMAND_EXECUTION]: The core workflow requires subagents to implement features and run tests, which inherently involves executing code and modifying files in the local environment. While intended for its primary purpose, this provides an execution surface for any instructions found in the task descriptions.

subagent-driven-development