The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests and processes untrusted data from external specifications and codebase files to automate file creation and git operations.\n
Ingestion points: Reads the full body and comments of user-supplied specs, maps, and project glossary files (SKILL.md, Steps 1 & 2).\n
Boundary markers: None; external content is interpolated into the agent's context without clear delimiters or instructions to ignore embedded commands.\n
Capability inventory: Directs the agent to create directories via mkdir -p, write files to .scratch/ paths, and execute git add and git commit (SKILL.md, Step 5).\n
Sanitization: None; the skill does not explicitly validate or sanitize the content of the processed files.\n
Mitigation: A 'Green-light publication' step requires explicit user approval before any permanent files are written or committed, mitigating the risk of automated malicious actions.\n- [COMMAND_EXECUTION]: The skill utilizes standard system commands to manage its output artifacts and project state.\n
Evidence: Employs mkdir -p for directory management and git for version control tasks. These operations are scoped to local project directories and are consistent with the skill's documented purpose.

to-tickets