The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from product context files and workspace signals (Step 1, Step 6). This data is interpolated into context packages for downstream agents, creating a surface where malicious instructions in story descriptions could influence subsequent agent behaviors.
Ingestion points: Reads story definitions from product-context.yaml, product/index.yaml, and status signals from .feature-workspaces/.
Boundary markers: The instructions lack explicit delimiters or instructions to treat ingested story data as untrusted text during context assembly.
Capability inventory: The skill has the ability to execute shell commands (git, npx), write to the local filesystem, and route tasks to other specialized agents.
Sanitization: The skill performs structural YAML validation but lacks semantic filtering or sanitization of the story content before it is passed to other agents.
[DYNAMIC_EXECUTION]: The skill provides instructions to execute a JavaScript snippet for advanced YAML validation using npx tsx -e (references/yaml-guardrails.md).
Evidence: npx tsx -e "const { loadProductContext } = require('@agentic-engineering-patterns/api/lib/product-context-loader'); ..."
[COMMAND_EXECUTION]: The skill performs shell operations for environment discovery, syntax validation, and version control.
Evidence: Uses ls and cat for mode detection, npx js-yaml for validation, and git add/commit/push for synchronization of state.
[REMOTE_CODE_EXECUTION]: The skill executes external Node.js packages (js-yaml, tsx, and the vendor package @agentic-engineering-patterns/api) using npx without specific version constraints. This introduces a supply chain risk if the package registry or the specific vendor package is compromised.

aep-dispatch