The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted user input directly into prompts for sub-agents across all phases (planning, execution, verification, and review).
Ingestion points: The spec input, provided via CLI arguments or positional text in __init__.py, is used throughout the BuildWorkflow in workflow.py.
Boundary markers: None. The spec content is written to a file (spec.md) and referenced in prompts (e.g., f"Spec file: {spec_path}\nRead the spec file above carefully.") without clear delimiters to prevent the sub-agents from following instructions embedded within the data.
Capability inventory: The skill uses spawn_subagent (with tools_needed=True), write_artifact to modify the filesystem, and emit_finding to report results.
Sanitization: There is no evidence of sanitization, escaping, or validation of the spec content before it is processed by the sub-agents.
[COMMAND_EXECUTION]: The workflow creates a significant command execution surface by instructing sub-agents to run code generated during the process.
Evidence: In workflow.py, the "verifier" sub-agent is explicitly prompted to "Run tests, linting, or checks as appropriate" on the outputs generated in the execution phase. Since these outputs are derived from the untrusted spec, an attacker could craft a specification that generates and subsequently executes malicious code during the verification step.

build-temporal