The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands including python3 ./.trellis/scripts/get_context.py and cat to read various specification files. While these are standard for developer workflow automation, they represent the execution of local scripts whose contents are not defined within the skill itself.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by instructing the agent to ingest and follow instructions from external markdown files within the repository.
Ingestion points: The agent reads requirements and guidelines from prd.md, design.md, implement.md, and multiple files located under .trellis/spec/ (Step 1, 4, 5, 6).
Boundary markers: Absent. There are no instructions or delimiters provided to help the agent distinguish between its core instructions and potentially adversarial instructions embedded in the project files.
Capability inventory: The skill itself uses python3 and cat for discovery. The instructions explicitly direct the agent to "proceed with your development plan" after reading these files, implying the agent possesses broader capabilities such as file modification and further command execution.
Sanitization: Absent. The skill does not include any validation or sanitization of the content read from the local files before the agent is told to "Follow the 'Pre-Development Checklist'" and follow the coding standards found therein.

trellis-before-dev