The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow instructions for both RFCs and implementation plans direct the agent to execute local validation tools, specifically node scripts/check-specs.mjs and pnpm docs:check. These commands are used to verify documentation metadata and link integrity within the repository environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions alongside existing repository content (such as AGENTS.md, design documents, and existing RFCs/plans) to generate new documentation. This ingestion of potentially untrusted or external data creates a surface for indirect prompt injection, where malicious instructions embedded in processed files could attempt to influence the agent's output or actions.
Ingestion points: The agent reads existing repository documentation, source code, tests, and user-provided descriptions from the SKILL.md instructions and workflow files (references/plan.md, references/rfc.md).
Boundary markers: The instructions do not specify the use of clear delimiters or guardrails to separate ingested repository content from the agent's primary instructions.
Capability inventory: The skill possesses the ability to read from the filesystem, write new Markdown documents to specific directories (specs/plans/, specs/rfcs/), and execute local scripts via Node.js/pnpm.
Sanitization: While the instructions mandate a 'technical-writing clarity pass' and manual review of the generated documents, there are no explicit technical sanitization or filtering mechanisms described for the data being ingested.

spec