The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions mandate high autonomy by requiring the agent to submit the PRD to GitHub immediately without requesting a user review ("Submit immediately via gh issue create — don't ask for review"), which reduces oversight for potentially sensitive or malicious content generated during the process.
[PROMPT_INJECTION]: The skill processes untrusted data from the codebase, creating a surface for indirect prompt injection. Maliciously crafted comments or code could influence the PRD's content or the agent's subsequent actions.
Ingestion points: Codebase analysis using Agent (Explore), Read, Grep, and Glob tools in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands when reading files.
Capability inventory: The skill possesses the ability to execute shell commands via Bash and publish content to GitHub via the gh CLI.
Sanitization: No sanitization or filtering is applied to the data ingested from the codebase before it is used to generate the PRD or displayed in the visual companion.
[COMMAND_EXECUTION]: The skill initiates a local Node.js server (visual-server.cjs) to host a visual companion. While the server is restricted to localhost and employs a Content Security Policy (script-src 'self'), it renders arbitrary HTML via innerHTML in poll.js, which could be abused if the agent is influenced by malicious data to inject malicious HTML or event handlers.
[DATA_EXFILTRATION]: The skill is designed to publish information derived from the codebase to GitHub as public or shared issues. Users should ensure that the repository and the generated content do not inadvertently expose sensitive internal architectural details or secrets found during exploration.

write-a-prd