The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes task instructions and acceptance criteria from an external, potentially untrusted source (TODO.md).
Ingestion points: The agent reads ticket IDs, parent specifications, and detailed acceptance criteria from the TODO.md file located in the repository.
Capability inventory: The skill is authorized to perform file modifications ("Implement only its criteria") and execute verification routines ("Run focused checks and a behavior-level smoke check").
Boundary markers: While the skill instructs the agent to "Confirm concrete, unambiguous acceptance criteria" and "Review correctness, regressions, security, and scope," there are no formal delimiters or negative constraints to prevent the agent from obeying malicious instructions embedded within a ticket's criteria.
Sanitization: There is no evidence of sanitization or filtering applied to the text read from TODO.md before it is used to guide implementation and command execution.

implement-it