The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external project files such as .devflow/index.md, state.md, spec.md, and brief.md to determine the current project 'route'. Because these files are read from the user's workspace, they could contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Data is read from multiple paths including .devflow/index.md, .devflow/project/, .devflow/team/, .devflow/work/, and .devflow/adoption/.
Boundary markers: The skill instructs the agent to return a specific report format with four distinct fields, which provides structural delimitation. However, there are no explicit instructions for the agent to ignore or sanitize prompts embedded within the processed project files.
Capability inventory: The scripts/runtime/common.mjs script provides the ability to read files (readFile), create directories (mkdir), and spawn child processes (spawn).
Sanitization: No explicit sanitization or validation of the natural language content within the project files is defined.
[COMMAND_EXECUTION]: The skill's runtime utility library (scripts/runtime/common.mjs) contains a runChild function that uses node:child_process.spawn to execute shell commands. While this function is not called by the current entry point script (scripts/run.mjs), the capability exists within the skill's distributed scripts. The function includes safety controls such as a 10-second execution timeout and a 4MB output size limit.

resume