The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local commands using a CLI tool named bd to create tasks and epics.
Evidence: In Step 9, the skill uses bd create with arguments such as --description and --acceptance which are populated with content parsed from the PRD file. If the PRD contains shell metacharacters or maliciously crafted strings, it could lead to unintended command execution depending on the agent's shell handling.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from the filesystem.
Ingestion points: docs/prd.md and existing files in docs/stories/ are read into the agent's context.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings when processing the PRD content.
Capability inventory: The skill has the ability to write files to the docs/stories/ directory and execute shell commands via the bd tool.
Sanitization: While the skill includes a strong sanitization step for filenames (stripping /, \, and ..), it does not explicitly instruct the agent to sanitize or escape the content used in the bd command arguments or the content written to the story files.
[SAFE]: The skill demonstrates positive security awareness by explicitly instructing the agent to avoid sensitive files.
Evidence: Step 1 contains a clear directive: "Do NOT read or surface the contents of secrets files (.env, *.key, credentials.*, secrets/). Do not reproduce literal hostnames, connection strings, or API keys in story files."

prd-to-stories