The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it ingests and processes untrusted data from external sources during the subagent dispatch and review process.\n
Ingestion points: Task descriptions from plan.json, architectural decisions from spec.md, and implementation reports generated by subagents (referenced in SKILL.md and templates).\n
Boundary markers: The templates in references/ use markdown headers and placeholders (e.g., ## Task Description, {FULL TEXT ...}) to delimit external content, which provides some structural separation but does not prevent malicious instructions within that content from influencing the agent.\n
Capability inventory: The skill facilitates file reading/writing (via the implementation tasks) and utilizes task management tools (e.g., the bd command mentioned in SKILL.md for closing tasks).\n
Sanitization: There is no explicit evidence of sanitization, escaping, or validation of the external text before it is interpolated into the reviewer and implementer prompts.

code-subagents