The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from chat history and local configuration files to guide its execution.
Ingestion points: The protocol reads from the chat discussion in Step 0 and Step 1; it also reads local files like meta/workflows/automated-testing/automated-testing-instructions.md in Step 4 and meta/workflows/execution/execution-instructions.md in Step 7.
Capability inventory: The skill dispatches subagents to perform file modifications, executes "project-wide verification commands" in Step 4, and performs git commit in Step 6.
Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are specified for the ingested content in the skill definition.
Sanitization: The instructions do not specify any sanitization or validation for the inputs derived from chat or local files before they influence command execution or file writes.
[COMMAND_EXECUTION]: The skill instructs the agent to run project-specific verification and execution commands.
Evidence: Step 4 mentions running "every applicable project-wide verification command," and Step 7 involves following instructions from execution-instructions.md which typically includes shell commands. This behavior is expected for a developer-oriented skill but constitutes a capability that can be targeted by injection.

execute-chat