The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes unstructured and potentially untrusted data from external sources, creating a surface for indirect prompt injection attacks.
Ingestion points: Meeting transcripts, discovery calls, Slack messages, and emails are ingested as primary inputs for requirements structuring (see SKILL.md, references/00-clarification.md, and references/09-nl-to-workflow.md).
Boundary markers: The skill implements a 'Gate Protocol' (SKILL.md) requiring explicit human confirmation between phases and before executing mutations. It also uses structured persistence rules (references/11-artifact-persistence.md).
Capability inventory: The agent can write markdown artifacts to the local docs/ directory and perform mutations (issue creation/update) via the GitLab MCP (SKILL.md, references/01-structuring.md).
Sanitization: The skill offloads complex calculations (RICE, WSJF, DAG, Monte Carlo) to local Python scripts rather than performing them via natural language reasoning, providing a layer of logic separation.
[DYNAMIC_EXECUTION]: The skill generates JSON data structures from user input and executes them through local Python scripts.
Evidence: Instructions in references/02-prioritization.md, references/04-forecast.md, and references/10-okr-aligner.md describe assembling data into JSON files and running them via python3 scripts/*.py commands.
Mitigation: The execution is limited to pre-packaged, local scripts provided within the skill's own directory, significantly reducing the risk compared to executing remote or arbitrary code.

ns-project-manager