The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of gathering external data and writing it to the file system.
Ingestion points: The agent gathers untrusted data through the AskUserQuestions tool and via results from Task subagents that search the codebase and analyze system impact (documented in SKILL.md and references/interview-questions.md).
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying malicious instructions that might be embedded in the user requirements or the codebase files being analyzed.
Capability inventory: The skill has the capability to write to the local file system (saving specifications to the specs/ directory) and can trigger other agents through the Task tool.
Sanitization: There is no evidence of input validation, escaping, or filtering of the content gathered during the 'Discover' and 'Interview' phases before it is interpolated into the final markdown specifications.

feature-forge