The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's research phase (Step 2 in SKILL.md) involves reading existing repository code, manifests, and documentation to serve as the 'design authority'. This creates an attack surface where malicious instructions embedded in the codebase (e.g., in comments or documentation) could influence the resulting design and task inventory.
Ingestion points: SKILL.md Step 2 instructions to 'Trace the current flow end to end. Read the closest implementations, callers, tests, manifests, data boundaries, and repository instructions.'
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded natural language instructions within the code files it researches.
Capability inventory: The skill generates markdown files containing executable 'Acceptance criteria' commands (e.g., `T003
{task name}inreferences/task-generation.md`).
Sanitization: The instructions do not specify any validation or sanitization of the content extracted from the repository before it is used to generate these task commands.
[COMMAND_EXECUTION]: The skill is designed to generate shell commands for 'Acceptance criteria' within task files. While the skill itself does not execute these commands, it prepares them for execution by an 'implementing agent' or user to verify task completion.
Evidence: references/task-generation.md specifies that 'Every acceptance item is executable without human inspection' and should include 'exact runnable command, grep, typecheck, build, or file check'.

roadmap