The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and act upon the contents of external specification files (spec-phase-*.md), which creates a surface for indirect prompt injection if those files are poisoned or maliciously crafted.
Ingestion points: Specification files are read in SKILL.md (Step 1: Load Specification) and their contents are used to drive the agent's actions.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to disregard instructions embedded within the data, making it susceptible to malicious overrides in the spec file.
Capability inventory: The skill has access to high-privilege tools including Bash, Write, Edit, and the ability to spawn sub-agents via Agent.
Sanitization: No sanitization or verification logic is present to validate the commands or code patterns extracted from the specification before execution or implementation.
[COMMAND_EXECUTION]: The skill extracts and executes shell commands from the Feedback Strategy and Validation Commands sections of the specification files.
Evidence: In SKILL.md (Step 5: Set Up Feedback Environment), the agent is instructed to "Start whatever the playground needs (test runner, dev server, storybook) and run the inner-loop command once."
Evidence: In SKILL.md (Post-Execution: Verify), the agent is instructed to "Run all of the spec's Validation Commands (type check, lint, tests, build)."
Risk: If the specification file contains a malicious command in these fields, the agent will execute it via the Bash tool, potentially leading to unauthorized system actions.

execute-spec