The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates user-provided $ARGUMENTS directly into prompts for subagents in Phase 2. This creates a surface for prompt injection where an attacker could provide a task description designed to override agent instructions or hijack the subagent's behavior.
[DATA_EXFILTRATION]: The skill sends codebase contents (relevant source files) and git diffs to external LLM services (Gemini and OpenAI) via the mcp__consult-llm__consult_llm tool. While these are well-known technology services, this behavior exposes potentially sensitive local code to third-party APIs by design.
[COMMAND_EXECUTION]: In Phase 5, the skill autonomously implements a plan generated by the LLMs, which involves writing code to files and committing them to the repository. While this is the intended functionality, the lack of a mandatory human-in-the-loop review before implementation (unless --dry-run is used) presents a risk of executing or committing malicious code generated during an indirect prompt injection attack.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection from the codebase it analyzes.
Ingestion points: Phase 1 uses codebase exploration tools (Glob, Grep, Read) to collect context (SKILL.md).
Boundary markers: Absent. Context summaries and file contents are interpolated directly into prompts for Phase 2 and Phase 3 without delimiters or 'ignore' instructions.
Capability inventory: The agent can modify the file system and perform git commits (Phase 5).
Sanitization: Absent. The skill does not sanitize or validate contents read from the codebase before including them in the LLM prompts.

debate