The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes a context injection architecture where sub-agents (implement, check) receive automated context from files listed in .jsonl manifests within task directories. This creates a surface for indirect prompt injection if malicious content is introduced into the project files referenced by these manifests.
Ingestion points: The inject-subagent-context.py hook (documented in references/claude-code/hooks.md) reads and interpolates files listed in implement.jsonl, check.jsonl, and debug.jsonl into the agent's system prompt.
Boundary markers: The system uses simple Markdown headers (e.g., === .trellis/spec/cli/backend/index.md ===) to delimit injected files. There is no evidence of robust delimiters or explicit 'ignore embedded instructions' warnings for the injected content.
Capability inventory: The specialized agents described (implement, check, debug) have access to high-privilege tools including Bash, Write, Edit, and Read across the project tree.
Sanitization: The documentation for the hook logic does not mention sanitization, filtering, or validation of the content being injected from the external files.
[DATA_EXFILTRATION]: The architecture includes a 'cross-session memory' feature (trellis mem) that enables the AI to search and extract context from raw conversation logs of various platforms (Claude Code, Codex, Pi Agent) stored in the user's home directory (e.g., ~/.claude/projects/, ~/.codex/sessions/, ~/.pi/agent/sessions/). While this is a documented feature for session recall, it involves accessing sensitive personal interaction history.
[DYNAMIC_EXECUTION]: The skill documents the use of project-local Python scripts (session-start.py, inject-subagent-context.py) and a quality enforcement runner (ralph-loop.py) that are executed as lifecycle hooks by the platform. The ralph-loop.py script specifically executes shell commands defined in the project's worktree.yaml configuration file. This dynamic execution is part of the tool's core functionality for automating developer workflows and verification tasks.

trellis-meta