The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it is instructed to ingest untrusted data from external sources during the context exploration phase.
Ingestion points: The skill reads project files, documentation, and recent git commits (Workflow Step 1) and accepts user-provided input via the $ARGUMENTS variable.
Boundary markers: The instructions do not define specific delimiters or security warnings to prevent the agent from obeying instructions that might be embedded in the files or commit messages it reads.
Capability inventory: The skill has the ability to write files to the .start/ideas/ directory and invoke other skills like /start:specify.
Sanitization: No explicit sanitization or validation of the ingested project data is mentioned in the instructions.
[COMMAND_EXECUTION]: The skill requires the agent to perform local environment inspection to build a mental model of the project.
Evidence: Instructions in 'Workflow Step 1: Explore Context' direct the agent to 'Check project files, documentation, and recent git commits' to identify patterns and constraints. This typically involves the execution of standard discovery commands such as ls, cat, or git log. This behavior is consistent with the skill's primary purpose.

brainstorm