The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from several local project files to generate formal specifications, creating a surface for indirect prompt injection.
Ingestion points: Data is ingested from .scratch/<feature>/clarify-handoff.md, .scratch/<effort>/map.md, and resolved ticket ## Answer records, as well as the current conversation context as described in WORKFLOW.md.
Boundary markers: Absent. While the skill follows a specific output template defined in OUTPUT-FORMAT.md, it does not use technical delimiters or safety markers to isolate the ingested external content from its own instructions.
Capability inventory: The skill is capable of reading project documentation (ADRs, glossary, maps), writing files to the .scratch/ directory, and executing the light-html-plan tool as indicated in SKILL.md.
Sanitization: Absent. There are no instructions to sanitize, escape, or validate the content retrieved from external files before it is processed by the model.

project-spec