The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on a chain of artifacts where user input is transformed into technical plans and then executed. This creates a surface for indirect instructions to influence the agent's behavior.
Ingestion points: User input is ingested into catalog/intent.md through the requirement gathering process.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore nested prompts within the artifacts (intent.md, spec.md, plan.md).
Capability inventory: The agent is authorized to create directories (mkdir -p), write/modify files, and execute shell commands (test runners like pytest, bun test, npm test) as specified in the generated plans.
Sanitization: There is no evidence of sanitization or validation for the content generated in the artifacts before they are used to drive further actions.
[COMMAND_EXECUTION]: In the execution phase (catalog/run.md), the agent is instructed to run automated tests and build commands defined in the plan.md file's verification section. Since the contents of plan.md are derived from the previous SDLC stages, a malicious user could potentially influence the planning process to inject arbitrary commands that the agent would then execute during the implementation phase.

sdlc-lgnh