The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection where malicious instructions in the codebase or user-provided requirements could be interpolated into internal prompt templates.
Ingestion points: Target requirements provided to SKILL.md and codebase information retrieved via mcp__serena in references/research-phase.md.
Boundary markers: The prompt templates in references/architecture-reviewer.md, references/completeness-reviewer.md, and others use simple placeholders (e.g., [PLAN_CONTENT]) without boundary markers or instructions to ignore embedded commands.
Capability inventory: The skill possesses the ability to read and write files, perform external web searches via Perplexity and Exa, and dispatch autonomous sub-agents.
Sanitization: There is no evidence of sanitization or escaping of the plan content or codebase summaries before they are processed by the reviewer agents.
[DATA_EXFILTRATION]: The skill's research and review phases involve sending local codebase context (symbols, structure, and logic) to external AI providers such as Perplexity and Exa. While this is part of the tool's intended research functionality, it results in the exposure of private codebase data to third-party services.
[COMMAND_EXECUTION]: The skill generates implementation plans specifically formatted for execution by "agentic workers." These plans include explicit shell commands (e.g., pnpm add, pnpm test) and full code snippets. If the plan generation process is manipulated via injection, the skill could facilitate the creation of a malicious execution sequence for a downstream agent.

design