The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the codebase and conversation context to generate specifications. This creates an attack surface where malicious content in the codebase could influence the agent's output or subsequent actions.
Ingestion points: Repository exploration and current conversation context (SKILL.md).
Boundary markers: None specified; there are no instructions for the agent to ignore or delimit embedded instructions within the source material.
Capability inventory: File system read (repo exploration), file system write (local spec artifact), network operations (tracker publication), and subprocess execution (plannotator).
Sanitization: No explicit sanitization or escaping of the ingested data is described before it is written to the specification.
[COMMAND_EXECUTION]: The skill instructs the agent to run the plannotator annotate command. While this is gated by an explicit user request, it represents the execution of a shell command based on the skill's generated content.
[DATA_EXFILTRATION]: The skill's primary purpose includes publishing synthesized project data to external project trackers (like GitHub Issues or Jira) when requested. This is a functional requirement but involves sending potentially sensitive project information over the network.

atlas-to-spec