The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (STORY_CONTENT) which is used to drive the core logic of the swarm, including flag detection (HAS_API, HAS_REFACTORING, etc.) and agent spawning decisions. There are no explicit boundary markers or instructions to the agent to disregard potential instructions embedded within the user story content.
Ingestion points: The STORY_CONTENT parameter in SKILL.md and steps/01-flag-detection.md.
Boundary markers: Absent. The instructions do not specify the use of delimiters (like XML tags or triple quotes) to separate user data from agent instructions.
Capability inventory: Spawning multiple agents via the Task tool, executing shell commands (aqe, npx, ruflo), and writing results to the OUTPUT_FOLDER.
Sanitization: Absent. The skill does not instruct the agent to sanitize or escape the content before analysis or interpolation.
[DYNAMIC_EXECUTION]: In steps/07-learning-persistence.md, the skill defines shell command templates for aqe memory store that interpolate variables like ${storyId} and findings content. If the storyId or story title is extracted directly from the user-provided story content without sanitization, it could lead to command injection when the agent executes the command in a shell environment.
[COMMAND_EXECUTION]: The skill relies on local CLI tools (aqe, ruflo via npx) to perform memory searches and store results. While these appear to be part of the intended framework, the use of shell commands with data derived from user input increases the overall attack surface.

qcsd-refinement-swarm