The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from external, untrusted files that could contain malicious instructions.
Ingestion points: The skill accepts paths to PRD references, database schemas (DDL/migration files), and existing OpenAPI specs via the $ARGUMENTS input in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or explicit guardrails to prevent the agent from following instructions that might be embedded within the project documents it parses.
Capability inventory: The skill utilizes the Write tool for outputting contracts, the Edit tool for project configuration (jaan-to/config/settings.yaml), and the Task tool for executing shell scripts like id-generator.sh and index-updater.sh during its generation phase.
Sanitization: There is no evidence of sanitization, filtering, or validation logic applied to the content extracted from ingested files to strip out potential prompt injections.

backend-api-contract