The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents a significant surface for indirect prompt injection by ingesting untrusted data from multiple sources without sanitization or boundary markers.
Ingestion points: Phase 1 (Initial user ideas), Phase 2 (User responses to Socratic questions), and Phase 3 (Results from the web-search-researcher subagent) are all interpolated into the agent's context in SKILL.md.
Boundary markers: The instructions do not define any delimiters (e.g., XML tags, triple backticks) or specific instructions to the agent to disregard embedded commands within these inputs.
Capability inventory: The skill has the capability to write files to the docs/brainstorms/ directory (Phase 5) and perform deep codebase analysis using the codebase-locator, codebase-analyzer, and codebase-pattern-finder subagents (Phase 3).
Sanitization: There is no evidence of input validation, escaping, or filtering for the data retrieved from web searches or provided by the user.
[DATA_EXFILTRATION]: The skill explicitly instructs subagents in Phase 3 to locate and analyze "Configuration and setup files" and "Integration points" within the codebase.
Evidence: In SKILL.md under Phase 3, the codebase-locator is prompted to find "Configuration and setup files" and the codebase-analyzer is tasked to "Trace the data flow and identify integration points... include file:line references."
Risk: While intended for architectural brainstorming, these instructions provide a mechanism for the agent to inadvertently include sensitive configuration details (such as environment variable names, internal paths, or architectural secrets) in the final brainstorming document written to the docs/ folder.

brainstorm