The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from seven different markdown files in the specs/ directory and uses this content to generate a detailed task list in specs/TASKS.md. If these input files are modified by an untrusted party, they could contain instructions designed to influence the agent's behavior, such as including malicious commands in the generated verification fields.
Ingestion points: specs/PRD.md, specs/ARCHITECTURE.md, specs/DATABASE.md, specs/SECURITY.md, specs/DESIGN_SYSTEM.md, specs/CODE_STYLE.md, and specs/TESTING.md.
Boundary markers: The skill lacks explicit instructions or delimiters to treat the content of the specification files as untrusted data or to ignore any embedded instructions within them.
Capability inventory: The skill primarily performs file read operations and writes the resulting task graph to specs/TASKS.md. While it does not execute code itself, the output it produces is intended to be used by developers and other agents, potentially creating a downstream risk if the output is poisoned.
Sanitization: No sanitization or validation of the input content is performed to filter out potentially malicious instructions or unusual control characters.

task-decomposer