The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it retrieves external web data during the research phase.
Ingestion points: External web content is ingested via agent-browser, WebSearch, and WebFetch during Phase 2 (Research) in SKILL.md and references/research-cascade.md.
Boundary markers: Explicit boundary instructions are present in references/research-cascade.md under "Untrusted Content Rules", directing the agent to ignore instructions found in fetched pages and cross-verify claims.
Capability inventory: The skill possesses file write access (Write tool used to output 1-requirements.md and intent-<key>.md) and local shell execution capabilities via allowed tools (Bash, grep, git diff).
Sanitization: The skill outlines strict security guardrails including path validation (docs/features/<slug>/), regex slug validation (/^[a-z0-9][a-z0-9._-]*$/i), and a 2-tier secret redaction scan to mask or abort on sensitive data.

req-analyze