verification-before-completion

[INDIRECT_PROMPT_INJECTION]: The verification protocol involves reading the full output of various development commands (e.g., tests, builds, linters) in Phase 3. This is a primary ingestion point for untrusted data from the local project environment. The skill lacks instructions for using boundary markers or sanitization to prevent the agent from interpreting content within these outputs as instructions. Given the agent's capabilities to execute further shell commands and write files based on these results, this represents an indirect prompt injection surface.

• Ingestion points: Phase 3 requires reading the entire output of verification commands from the project environment.
• Boundary markers: None identified in the protocol.
• Capability inventory: The agent is expected to execute shell commands and modify code based on the verification results.
• Sanitization: No escaping, filtering, or validation of the ingested output is instructed.