The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from web searches (WebSearch), website content (WebFetch), and external "expert reports" or "investigation reports" to create tickets and perform knowledge capture. There is a risk that malicious instructions embedded in these external sources could influence the agent's orchestration decisions or be incorporated into persistent skill updates.
Ingestion points: Web search results, fetched web content, and external investigation reports are ingested into the agent's context in SKILL.md and references/orchestration-and-tickets.md.
Boundary markers: The instructions do not specify technical delimiters or "ignore previous instruction" wrappers when processing these external data sources.
Capability inventory: The skill has the capability to orchestrate multiple agents, manage Jira tickets, and write to the filesystem to update skill definitions.
Sanitization: While the skill provides "Quality Rules" for knowledge capture in references/knowledge-and-retro.md, these are natural language guidelines rather than technical sanitization or validation of the input data.
[DYNAMIC_EXECUTION]: The "Sprint Knowledge Capture" protocol in references/knowledge-and-retro.md instructs the agent to "Apply approved updates to skill files in ~/.claude/skills/ (user level) or project-level .claude/skills/." This constitutes dynamic modification of the agent's own instructional logic. If the sprint data used to generate these updates contains malicious patterns, it could lead to the persistence of harmful behaviors across the agent's entire skill set.

scrum-master