The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes task descriptions from user prompts or external requirements files, which serves as an ingestion point for potentially malicious instructions.
Ingestion points: User prompts and requirements files (SKILL.md).
Boundary markers: The skill lacks explicit input delimiters but uses a human-in-the-loop "Validation Gate" at the output stage.
Capability inventory: The agent can read codebase files and documentation, create directories, and write a single spec.md file (SKILL.md).
Sanitization: The agent is strictly instructed to present the full draft and filename for explicit user validation before writing to the filesystem.
[SAFE]: The instructions include a strict read-only constraint for all source code, configuration files, and project files, preventing unauthorized modifications.
[SAFE]: Filesystem write permissions are limited to a scoped directory path (docs/specs/), which mitigates the risk of arbitrary file creation or system-level tampering.

dev-analyze