The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to read external markdown files provided by users and pass their content verbatim to multiple sub-agents. These files represent untrusted input that could contain instructions designed to override the agent's behavior.
Ingestion Point: Captured in SKILL.md via instructions to read a user-provided file path and pass its text verbatim to sub-agents.
Boundary Markers: The skill does not currently specify the use of delimiters or explicit instructions for the sub-agents to ignore embedded commands within the spec text.
Capability Inventory: Sub-agents are explicitly instructed to use the task tool for general-purpose operations, which include running CLI tools, building projects, and executing shell commands to verify the technical mechanics of the proposal.
Sanitization: No evidence of sanitization or filtering of the captured specification text before it is interpolated into sub-agent prompts.
Potential Command Execution Risk: The core methodology of the skill encourages "empirical verification" through the execution of tools and the creation of throwaway projects in temporary directories. In a scenario where a malicious design specification provides deceptive technical claims, a sub-agent attempting to verify those claims might be tricked into executing unintended or risky commands as part of its research process.

spec-review