The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes external data sources that could potentially contain malicious instructions.
Ingestion points: The skill explicitly ingests feature descriptions, repository content, API responses, and test data as documented in SKILL.md.
Boundary markers: The skill contains a 'Trust boundary' section that strictly instructs the agent to treat all ingested data as evidence rather than authoritative instructions and to validate all actions against a decision contract.
Capability inventory: The skill is intended to build and run code 'probes' which involve file system access and potentially network operations.
Sanitization: The references/evidence-strategies.md file mandates the use of 'sanitized' request and response data when recording evidence.
[DATA_EXFILTRATION]: The skill contains explicit defensive instructions to prevent data leakage. It forbids copying raw production data, credentials, tokens, or personal information into fixtures or findings, and instructs the agent to keep credentials in the project's approved local mechanisms (e.g., .env files).
[COMMAND_EXECUTION]: While the skill involves generating and executing code for technical spikes, it implements a policy of least privilege and human oversight by requiring explicit user approval before live deployments, privileged mutations, or creating paid resources.

feature-spike