The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes untrusted data from the codebase, existing plans, and user-provided prompts to generate or modify executable implementation tasks.
Ingestion points: The skill reads project source files (Step 3), implementation plans (Step 2.1), and architecture/roadmap documents (Step 2.2). It also accepts an optional improvement prompt via $ARGUMENTS.
Boundary markers: The validation subagent defined in references/VALIDATOR.md uses simple placeholders ({{PROJECT_CONTEXT}}, {{ITEMS}}) to interpolate potentially attacker-controlled content without using high-assurance delimiters or explicit instructions to the subagent to ignore embedded commands within that specific data.
Capability inventory: The skill has powerful capabilities including Write and Edit for file modification, and TaskCreate/TaskUpdate for modifying the agent's pending task list. A successful injection could theoretically leverage these to introduce malicious tasks or modify project code.
Sanitization: No specific escaping, filtering, or sanitization logic for the external content was found before it is processed or passed to subagents.

aif-improve