The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a robust defense-in-depth strategy to prevent instruction override. Rule 7 in SKILL.md explicitly mandates that all ingested content (such as documents, issues, and transcripts) must be treated strictly as data, not instructions. It specifically lists common injection patterns like 'ignore previous instructions' and 'output .env' as strings to be ignored and reported as concerns.
[CREDENTIALS_UNSAFE]: The skill contains strict guidelines for handling secrets. Rule 5 in SKILL.md and the recon instructions in recon.md forbid the reproduction of secret values. The agent is instructed to cite only the location and type of credential found and to recommend rotation, ensuring that sensitive data is not leaked into generated specifications or plans.
[COMMAND_EXECUTION]: The architect agent is governed by a strict 'no mutation' policy (Rule 2). It is prohibited from running commands that modify the user's working tree, such as installations or builds that write to non-standard directories. Permitted commands are restricted to read-only analysis and writing to authorized destinations like GitHub/GitLab via gh or glab CLI tools.
[REMOTE_CODE_EXECUTION]: Risk associated with executing generated code is mitigated through process isolation. The execute command in closing-the-loop.md dispatches a separate sub-agent into an isolated git worktree. This architectural separation ensures that any code changes are compartmentalized, requiring a manual tech-lead-style review and user approval before ever touching the primary branch.
[DATA_EXFILTRATION]: While the skill can write to external issue trackers, this behavior is opt-in and controlled. The destinations.md logic requires pre-flight checks, including repository visibility audits and explicit user confirmation, before publishing plans that might contain sensitive implementation details to public trackers.

blueprint