The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external JSON file and uses it to drive agent actions and code modifications.
Ingestion points: The skill reads refactor plans, quality checks, and validation commands from .agents/flow/it_{iteration}_audit.json and .agents/state.json.
Boundary markers: No delimiters or instructions are provided to the agent to treat the JSON content as data rather than instructions; the agent is explicitly told to 'Understand the refactor plan' and 'Apply all recommended code changes'.
Capability inventory: The agent has full file system write access (applying refactors) and arbitrary shell command execution privileges (running quality checks).
Sanitization: No sanitization or validation of the commands or code changes is performed before execution.
[COMMAND_EXECUTION]: The skill executes shell commands defined within the external refactor plan. While it suggests standard commands like bun run typecheck, it instructs the agent to run 'each quality check or command listed in the plan', which could include arbitrary malicious shell scripts.
[DYNAMIC_EXECUTION]: The skill resolves file paths for reading and writing completion reports dynamically using the iteration variable (e.g., .agents/flow/it_{iteration}_audit.json). This dynamic path construction could be susceptible to path manipulation if the variable is not strictly validated.
[PROMPT_INJECTION]: The skill includes instructions to increase agent autonomy, specifically directing it to 'perform the full refactor autonomously — do not stop mid-way to ask the user what to do next'. This concealment pattern reduces user oversight during the execution of commands derived from external data.

refactor-prototype