The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through the ingestion of task and sub-task specification files.
Ingestion points: The orchestrator reads metadata, model configurations, and implementation instructions from markdown files located in .specs/tasks/ and .specs/sub-tasks/ (SKILL.md).
Boundary markers: The skill uses markdown headers (e.g., ### Parallelization Overview) as delimiters for parsing, though these provide no protection against adversarial content intended to influence agent behavior.
Capability inventory: The orchestrator has the capability to execute shell commands (git diff, git mv, ls) and dispatch specialized agents (sdd:developer, sdd:code-reviewer, etc.) which have access to the project filesystem and developer tools.
Sanitization: The skill does not perform explicit sanitization, escaping, or validation of the content read from task files before interpolating that content into dispatch prompts for sub-agents.
[COMMAND_EXECUTION]: The workflow relies on shell commands for state management and change detection.
Evidence: The skill executes git diff to map manual changes to steps in --refine mode and git mv to transition task files between todo/, in-progress/, and done/ directories. These commands are executed using paths derived from user arguments and task file metadata.

implement-task