The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface by ingesting and processing data from the local environment.
Ingestion points: In SKILL.md, the agent is instructed to "Explore project context" by reading files, documentation, and recent git commits. This data is considered untrusted as it could contain malicious instructions embedded in comments or documentation.
Boundary markers: The instructions lack specific delimiters or "ignore embedded instructions" warnings for the agent when it processes these external files.
Capability inventory: The skill possesses the capability to write design documents to the file system and commit changes to the git repository.
Sanitization: No explicit sanitization, validation, or filtering of the ingested context is described before it is used to influence the design process.
[SAFE]: The skill incorporates a "HARD-GATE" mechanism that explicitly forbids the agent from performing any code generation, scaffolding, or implementation work until a design has been presented and approved by the user.
[SAFE]: The workflow is strictly controlled via a directed graph, ensuring that the only valid transition after design validation is to a specific planning skill, rather than autonomous execution of unknown implementation tools.

brainstorming