The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external project plans, specifications, or conversation histories which may contain untrusted data.
Ingestion points: External data enters the agent context through the 'Inputs' section of SKILL.md (plans, specs, or conversation history).
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore embedded commands within the ingested data.
Capability inventory: The agent is authorized to use the bd (beads) and gh (GitHub) CLI tools and to write documentation to docs/roadmaps/.
Sanitization: No explicit sanitization of input data is described before its use in tool invocations.
Mitigation: A mandatory 'Stop Or Checkpoint Rule' requires the agent to 'Confirm the slice list with the user before filing anything,' which provides a human-in-the-loop verification step to prevent the execution of malicious injected content.
[COMMAND_EXECUTION]: The skill workflow involves the execution of local command-line tools for task tracking.
Evidence: SKILL.md instructs the use of bd create, bd dep add, and gh tools to create and manage tickets. These commands are standard for project management tasks and are governed by a requirement for user confirmation.

skill-work-slicing