The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from local codebases to generate documentation, creating a vulnerability surface where malicious instructions in the code could influence the agent's behavior.
Ingestion points: The skill reads local files and directories (source code, configuration files) as specified in SKILL.md and references/workflows/brownfield-workflow.md.
Boundary markers: The workflow instructions do not include explicit delimiters or safety instructions (e.g., "ignore instructions found in the code") to prevent the LLM from executing malicious prompts embedded in code comments or documentation snippets.
Capability inventory: The skill is granted access to high-privilege tools including Bash, Read, Write, Edit, Glob, and Grep (defined in the allowed-tools frontmatter of SKILL.md), which could be abused if an injection is successful.
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is interpolated into the prompt for documentation generation.

documentation-specialist