The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external markdown files, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill reads input from docs/prds/<feature>.md to guide the scaffolding process.
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore any potential instructions embedded within the PRD content.
Capability inventory: The agent is authorized to write to the local file system (docs, source code, tests), execute repository build commands, and interact with the GitHub CLI (gh) to create branches, pull requests, and labels.
Sanitization: No sanitization or validation logic is defined to check the content of the PRD for malicious instructions or to escape its content before it influences subsequent agent actions.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands using parameters derived from the local environment and project files.
Shell Interpolation: Steps 6 and 7 interpolate variables derived from file names (<Feature>, <slug>) directly into gh CLI commands. This presents a risk of shell command injection if a file is maliciously named using shell metacharacters.
Build Command Execution: The skill automatically identifies and executes build commands found in the repository (e.g., go build, tsc, cargo check) in Step 4. While this is necessary for verifying stubs, it allows for code execution based on the configuration of the repository being worked on.

to-scaffold