The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external specification text that is interpolated into the system prompts for sub-agents, creating a vulnerability surface where malicious instructions in the input could influence sub-agent behavior.
Ingestion points: spec_text in references/decomposer-prompt.md; behaviour, acceptance_criterion, and spec_summary in references/curd-prompt.md and references/wiring-prompt.md.
Boundary markers: Uses markdown code blocks to delimit template sections, but lacks explicit escaping or instructions to sub-agents to ignore potentially malicious directions embedded in the specification data.
Capability inventory: Sub-agents have file-write permissions, can execute shell commands (phase commands and quality gates), and use codebase exploration tools (/culture, /briesearch).
Sanitization: No evidence of sanitization or validation of the interpolated specification content before it is placed into agent prompts.
[COMMAND_EXECUTION]: The skill executes dynamic commands based on the generated manifest file, which is populated with data derived from external specifications.
Evidence: The manifest-schema.json defines quality_gates as an array of shell commands, and curd-prompt.md instructs agents to run dynamic phase commands like /{phase} --auto.
Risk: If the decomposition process is manipulated via indirect prompt injection, an attacker could potentially inject malicious commands into the quality_gates or phase fields of the manifest.

ultracook