The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to 'Run every command in the Task's ## Verification section verbatim'. This creates a significant risk of remote code execution if a task specification file (e.g., task_NN.md) is modified by a malicious actor to include harmful shell commands.
[PROMPT_INJECTION]: The instructions contain directives to override standard agent behavior and safety protocols regarding user oversight. Specifically, it states 'Starts immediately when assigned, with no confirmation prompt' and 'Begin immediately: no greeting, no plan-approval question, no waiting for a "go"'. This increases the risk of the agent performing unauthorized actions autonomously.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection as it processes multiple untrusted external files (task_NN.md, _prd.md, _techspec.md, ADRs) and uses their content to guide file modifications and command executions.
Ingestion points: Reads task files and specification documents from the docs/specs/ directory.
Boundary markers: The skill lacks explicit instructions to treat embedded instructions in these files as data rather than commands, instead opting for 'verbatim' execution of specific sections.
Capability inventory: The skill can read/write files, execute arbitrary shell commands via the verification section, and perform git operations (status, diff, commit).
Sanitization: No evidence of command sanitization or validation is present before the execution of the verification pipeline.

implement-task