The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external markdown files which could potentially contain malicious instructions.
Ingestion points: The skill reads settled choices and source locators from .ai-workflow/work/<feature-slug>/decision-record.md.
Boundary markers: There are no explicit markers or instruction delimiters used when reading the decision record content.
Capability inventory: The skill's capabilities are limited to reading and writing markdown files within the local project directory; it does not have network, shell, or code execution tools.
Sanitization: No content sanitization or instruction-filtering is applied to the data read from the decision record.
[SAFE]: The skill does not perform network operations, execute shell commands, or access sensitive system paths. All operations are confined to the .ai-workflow directory, and the workflow requires explicit human approval ('Silence does not approve it') before marking documents as approved.

to-prd