The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates raw user input via the $ARGUMENTS variable directly into the agent's prompt context within the <arguments> block. While the skill instructions attempt to frame this as data rather than instructions, a malicious user could provide text designed to override the agent's objective or bypass the intended workflow.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted user data that is persisted to the filesystem, creating a potential injection surface for downstream tools that read the roadmap.
Ingestion points: User input provided via $ARGUMENTS (phase number) and interactive responses via the AskUserQuestion tool (user stories).
Boundary markers: The skill uses XML-style tags (<arguments>, <objective>, <process>) to attempt to delimit user data from system instructions.
Capability inventory: The skill has access to Read, Write, and Bash tools, allowing it to modify the local filesystem and execute shell commands based on the planning output.
Sanitization: The instruction references "user-story format validation" and "phase existence" gates within the external workflow file, though the specific implementation of this sanitization is not visible in the SKILL.md file itself.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform operations and delegates execution to other commands (e.g., /gsd plan-phase). This creates a path where user-influenced data (like the phase number or story content) could potentially influence command-line arguments if not strictly validated by the underlying workflow scripts.

gsd-mvp-phase