The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting and processing content from external repository files.
Ingestion points: The orchestrator reads task definitions and requirements from {product_root}/docs/versions/{version_san}/version-roadmap.md and requirements.md (SKILL.md, lines 31-35).
Boundary markers: The prompt template used to dispatch subagents (references/slice-dispatch.md) interpolates project variables and paths without using protective delimiters or "ignore embedded instructions" warnings for the ingested data.
Capability inventory: The orchestrator and its delegated subagents possess capabilities to modify the file system, manage git branches, and perform commits via mcp-gitlab-usage.
Sanitization: There is no evidence of content validation or sanitization for the data read from the roadmap or requirement files.
[COMMAND_EXECUTION]: The skill is designed to perform autonomous, multi-step execution of implementation tasks and git operations without intermediate human confirmation. This autonomy increases the potential impact of an indirect injection attack, though it is mitigated by mandatory stop conditions and a final human approval gate before moving versions to a completed state.

execution-orchestrator