The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains 'Unattended Mode Rules' that explicitly instruct the agent to suppress its standard behavior of seeking clarification or user confirmation. Phrases such as 'NO stopping for questions', 'NO asking for clarification', and 'Make autonomous decisions' act as instruction overrides that remove standard safety constraints and user oversight from the agent's workflow.
[INDIRECT_PROMPT_INJECTION]: The skill executes tasks parsed from external markdown design documents, creating a vulnerability surface where malicious instructions could be embedded in the task data.
Ingestion points: Markdown design files (e.g., design.md) are parsed by scripts/task_manager.py and processed by the agent loop defined in SKILL.md.
Boundary markers: There are no defined delimiters or warnings within the instructions to treat the task content as potentially untrusted data or to ignore embedded instructions.
Capability inventory: The agent is authorized to 'IMPLEMENT the task' (write code, modify files) and uses the task_manager.py script to read and write status updates to local files.
Sanitization: The task_manager.py script uses regex to parse task titles and criteria without any logic to sanitize or filter out potential prompt injection payloads contained within the text.
[COMMAND_EXECUTION]: The skill requires the agent to execute the local Python script scripts/task_manager.py with various arguments. While the script performs legitimate task management, its ability to read and write to arbitrary file paths provided via the --file argument provides a mechanism for local file modification based on agent actions.

feature-pipeline