The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill processes untrusted input from the user_ask parameter and incorporates it into the generated task DAG. There is a potential for malicious instructions embedded in the user request to influence the behavior of workers executing the resulting plan.
Ingestion points: External data enters the context via the user_ask trigger and the project-profile.yaml artifact as described in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands within the user_ask content.
Capability inventory: The generated tasks include high-capability operations such as environment preparation (target-env-prep), automated builds (smoke-test), and dependency remediation (cve-remediation) which are executed by downstream workers.
Sanitization: The instructions in SKILL.md and task-catalog.md explicitly direct the agent to preserve user-specified target versions verbatim, which may result in the propagation of unsanitized input into shell-executable contexts.

dag-generation