The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by having a coordinator and subagents ingest and modify external data, such as task briefs, project instructions, and implementation artifacts. This creates a surface for indirect prompt injection where malicious content in these files could influence agent behavior.
Ingestion points: The coordinator reads external "task and applicable project instructions" and "existing work" (SKILL.md). Subagents and the reviewer process the "artifact" (the deliverable being worked on).
Capability inventory: The workflow explicitly authorizes the "driver" subagent to "run commands that mutate shared state" and "edit the deliverable." The coordinator uses "delegation tools" to spawn and manage subagents.
Boundary markers: The instructions do not specify the use of strict delimiters or sanitization protocols to distinguish between agent instructions and the external data being processed.
Sanitization: There are no instructions for escaping or filtering untrusted content before it is processed by the subagents or the reviewer.
[COMMAND_EXECUTION]: The driver subagent is instructed to run commands to implement slices and perform checks. This capability, while necessary for the skill's primary purpose of pair programming, represents a potential execution vector if the deliverable or the instructions processed by the agent are compromised.

ping-pong