The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install additional skills from the author's repository using the command npx skills add pedroromeroluna/ai-first-product-skills. These resources originate from the same vendor as the skill author.
[COMMAND_EXECUTION]: The skill instructs the agent to suggest shell commands to the user, specifically npx commands for adding new skills to the environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided interview responses and writes them to local files, creating a potential surface for indirect injection if the input is malicious.
Ingestion points: User input is collected during the "Phase 2 — The interview" stage in SKILL.md.
Boundary markers: The skill explicitly includes a "Show before writing" rule that requires the agent to present the exact content to the operator and wait for a "go-ahead" before modifying the filesystem.
Capability inventory: The skill is capable of writing multiple markdown files (e.g., vision.md, problem.md, scope.md) to the local context/ or product-context/ directories.
Sanitization: Security relies on Human-in-the-Loop (HITL) review, as the agent is instructed to wait for explicit user approval before any file write operations occur.

prd