The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external PRD documents which could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: Untrusted data enters the agent context via the $ARGUMENTS variable or direct user paste as defined in SKILL.md.
Boundary markers: Absent. The instructions do not define delimiters (like XML tags or triple quotes) or provide warnings to the model to ignore any instructions embedded within the PRD content.
Capability inventory: The skill operates in a high-capability environment (Claude Code) with access to file system tools (cat, edit_file, ls) and shell execution (shell_execute), which could be abused if an injection is successful.
Sanitization: Absent. There is no evidence of filtering or escaping logic applied to the input text.
[COMMAND_EXECUTION]: The repository includes internal utility scripts that utilize subprocess execution.
Evidence: scripts/validate.py uses subprocess.run() to execute scripts/build.py using the system's Python interpreter.
Context: This behavior is benign as it is limited to internal build and validation workflows within the developer's controlled environment and is not triggered during the AI agent's runtime analysis of documents.

check-prd