The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a pipeline where output from one subagent (Implementer) is used as input for subsequent agents (Spec/Quality Reviewers). This architectural pattern creates a surface for potential indirect prompt injection if the implementer agent generates malicious instructions intended to influence the reviewer agents.
Ingestion points: The spec-reviewer-prompt.md and SKILL.md (Step 2 and 3) explicitly instruct the orchestrator to pass the Implementer's full response and changed files to the Reviewer agents.
Boundary markers: The skill uses structured HTML comment tags (defined in reference/handoff-tags.md) as delimiters to separate handoff data from other context.
Capability inventory: The execution environment includes high-privilege tools such as Bash, Agent (subagent dispatch), and TeamCreate (agent team coordination).
Sanitization: The skill mitigates risks by including mandatory verification instructions in spec-reviewer-prompt.md (e.g., 'DO NOT Trust the Report', 'You must independently verify every claim by reading the actual code').
[DATA_EXPOSURE]: No hardcoded credentials, sensitive file paths (outside of standard project documentation), or exfiltration patterns were identified. The skill correctly instructs developers to store secrets in appropriate environments rather than in the skill files.
[COMMAND_EXECUTION]: While the skill utilizes the Bash tool and coordinates agent activities, the commands are scoped to standard development tasks (git operations, file reading, testing). No patterns of arbitrary or unauthorized command execution were found.

subagent-driven-development