The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input during the 'Understanding' phase and uses it to author a design specification file (docs/specs/*.md). This file is then automatically passed as an argument to the exarchos:plan skill. The absence of explicit sanitization or strict boundary markers for user-provided data creates a surface where malicious instructions could be persisted in artifacts and executed by downstream agents or tools.
Ingestion points: User responses to clarifying questions in 'Phase 1: Understanding' (SKILL.md).
Boundary markers: Uses DR-N identifiers and Markdown headers, but lacks instructions to the LLM to ignore or escape instructions within user-provided descriptions.
Capability inventory: File system write (docs/specs/), skill chaining (exarchos:plan), and shell command execution (test -f).
Sanitization: No evidence of sanitization or validation of user input before interpolation into the spec document.
[COMMAND_EXECUTION]: During the 'Pre-Chain Validation' step in SKILL.md, the skill executes a shell command test -f "$SPEC_PATH" to verify the existence of the generated spec file. The file path is partially constructed from the feature name, which is derived from user input, creating a minor vector for path-based command injection or manipulation.

ideate