The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a multi-agent pipeline where the controller and various subagents (implementer, reviewer, re-reviewer) process and act upon data provided in the implementation plan and generated in subagent reports.
Ingestion points: Data enters the context via the user-provided PLAN_FILE and the REPORT_FILE generated by subagents during implementation and review cycles.
Boundary markers: The prompt templates utilize standard Markdown headers to demarcate input sections, but they do not employ robust delimiters or specific instructions to disregard potentially malicious commands embedded within the variable data being processed.
Capability inventory: The skill possesses the capability to modify the codebase, execute tests, and manage git history. The controller agent is instructed to make "rulings" and maintain "continuous execution," which involves interpreting input data to make workflow decisions.
Sanitization: There is no evidence of filtering or sanitizing content extracted from plans or reports before it is passed to other subagents or used for decision-making.
Risk Factor: The instructions in SKILL.md regarding "Continuous execution" and "Rulings, not stalls" reduce human-in-the-loop oversight, potentially allowing an indirect prompt injection to result in unauthorized or harmful actions without immediate detection.

subagent-driven-development