The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to interpret and execute instructions provided in external files, which serves as a significant attack surface for indirect prompt injection.
Ingestion points: The skill reads task definitions from files located in .scratch/<feature>/issues/ and project context from docs/agents/light-project.md and CONTEXT.md (as documented in SKILL.md and WORKFLOW.md).
Boundary markers: While the workflow suggests reading specific headers (e.g., ## What to build), there are no strict linguistic or technical boundaries to prevent the agent from obeying malicious instructions embedded within the ticket body.
Capability inventory: The skill allows for file modifications, running test-driven development cycles (tdd), and delegating tasks to other specialized profiles, providing a high-impact path for injected instructions.
Sanitization: The instructions do not prescribe sanitization or validation of the ticket content to distinguish between legitimate task data and adversarial instructions.

implement