The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, including route specifications, tracker issues, and project terrain data such as codebase files and ADRs. This content is interpolated into the task briefs for five parallel sub-agents, creating an attack surface for malicious instructions embedded in the analyzed documents.
Ingestion points: As described in Steps 1 and 2, the skill reads route content from file paths, tracker issues, or direct user input, and fetches terrain data including research outputs and resolution comments.
Boundary markers: The instructions lack explicit requirements for using delimiters or "ignore embedded instructions" warnings when passing external content to the doc-reviewer sub-agents in Step 3.
Capability inventory: The skill uses runs.run and runs.all to spawn sub-agents, performs configuration checks via subagent actions, and uses ask_user_question for interactive decision-making.
Sanitization: No explicit sanitization or filtering of the ingested external content is mentioned before it is processed by the sub-agents.

review-spec