The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input during its interview rounds and incorporates it into a final specification file.
Ingestion points: User responses are collected through the AskUserQuestion tool or plain-text fallback during Stage 3 (S3) of the state machine.
Boundary markers: While the skill uses a structured markdown template for the final output, it does not explicitly define delimiters or sanitization routines for user-provided strings when they are interpolated into the plan.
Capability inventory: The generated specification can be used by the agent to perform file operations (Read, Edit, Write), execute shell commands (Bash), or delegate tasks to other subagents (task) as described in the handoff contracts.
Sanitization: The instructions do not describe specific sanitization or escaping of user-provided content before crystallization into the final plan.
Analysis: This creates a potential surface for indirect prompt injection if a user provides malicious instructions that are later executed during the 'execute' phase. However, because this data flow is the primary and intended purpose of the requirements-gathering skill, the risk is inherent to the design rather than a malicious addition.

deep-interview