The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains defensive instructions against prompt injection. In references/agentic-setup.md, it explicitly directs the agent to ignore directives like 'ignore previous instructions' found in repo or research data and to report them instead. This is a security feature, not a vulnerability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (research notes, tracker content, workshop exports) to generate product documentation.
Ingestion points: Workflow Step 2 (Context gate) and Step 3 (Interview rounds) read data from the research directory (${SPECS_DIR}/research/) and external tracker tools.
Boundary markers: The skill establishes an 'Untrusted content boundary' in references/agentic-setup.md, mandating that repository and research content be treated as data, never instructions. It uses a structured evidence tagging system ([INTERVIEW], [DATA], etc.) to maintain provenance.
Capability inventory: The skill has restricted write access to specific files in the repository (product-brief.md, decision records, and templates) and uses read-only tracker operations.
Sanitization: The skill performs input validation on externally-sourced values used in shell or path interpolation (^[A-Za-z0-9._/-]+$) and requires a 'Skeptic pass' where a subagent validates every brief claim against the original source files.
[COMMAND_EXECUTION]: The skill uses specific, read-only platform tools for tracker access (e.g., search-issues, get-issue). These are controlled environment tools rather than arbitrary shell execution.
[DATA_EXFILTRATION]: The skill includes explicit rules for secrets hygiene in references/rules.md, forbidding the placement of tokens, credentials, or sensitive personal data into model outputs or logs.

om-discover