The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions facilitate an indirect prompt injection surface by requiring all agents in the workflow to read and update a shared file (design-state.md).
Ingestion points: Agents are mandated to read the design-state.md file at the start of every task and append data upon completion.
Boundary markers: The skill lacks requirements for delimiters, escaping, or explicit instructions to treat the file content as non-instructional data. This increases the risk that an agent will treat historical log entries as current, authoritative directives.
Capability inventory: Agents utilizing this skill typically possess file system access (to read/write the state file and project artefacts) and may have access to other project resources like configuration files (e.g., /tokens/colors.json).
Sanitization: The 'Handoff Chain' section records 'conversational babble' from agents, which is derived from previous interaction history. There are no instructions to sanitize this content, which can include user-provided overrides.
Evidence: The example provided in the Handoff Chain structure explicitly includes a User override: block. If an agent processes this history, it may mistakenly prioritize a past user instruction or a malicious injection embedded in a handoff message as a current command.

design-state