The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process "undocumented vibe-coded prototypes" from the local filesystem. This data represents an untrusted ingestion point where malicious instructions could be embedded to manipulate the agent's behavior.
Ingestion points: The pipeline defined in SKILL.md reads and analyzes local prototype code.
Boundary markers: The instructions do not specify the use of delimiters or "ignore" warnings when processing the contents of external code files.
Capability inventory: The agent has access to Bash, Read, and Write tools, which could be abused if an injection is successful.
Sanitization: Step 2 mentions a fixture-portability-validator which uses regex to scrub secrets and home folder paths from generated tests.
[COMMAND_EXECUTION]: The 10-step pipeline involves generating "executable discovery scripts" and "runnable assertions" (characterization tests) which are then immediately executed by the agent. This dynamic execution of generated content, especially when derived from untrusted prototype code, poses a risk of arbitrary code execution.
[COMMAND_EXECUTION]: The instructions direct the agent to "trigger" or "invoke" several CLI-style tools (e.g., vibe-browser-audit, runtime-observer). Without strict validation of input parameters such as filenames or routes extracted from the prototype, this could lead to command injection via the Bash tool.

vibe-to-speckit-superpowers