The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection because it autonomously processes and executes tasks derived from external, potentially untrusted sources.
Ingestion points: In SKILL.md, the autopilot is configured to discover tasks from team-tasks (Claude Code TaskList), swarm-tasks (MCP task_list), and file-checklist (Markdown checkbox items in tracked files).
Boundary markers: No boundary markers, delimiters, or system instructions are provided to help the agent distinguish between legitimate task data and potentially malicious instructions embedded within those sources.
Capability inventory: The skill leverages the Agent tool to spawn sub-agents and uses mcp__claude-flow__autopilot_predict to determine next actions, which can include sensitive operations like editing code or running tests.
Sanitization: There is no evidence of input validation or content sanitization applied to the tasks retrieved from the external sources before they are passed to the prediction and execution logic.

autopilot-loop