The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted repository data, including source code, existing ADRs, and agent instructions (as identified in SKILL.md and multiple Guide files). This establishes a surface for indirect prompt injection. However, the skill incorporates significant defensive measures:
Boundary Markers: Uses structured planning checkpoints, selection rationale announcements, and semantic status markers (AC-ADR-050) to distinguish agent intent from data.
Sanitization: AC-ADR-004 and AC-ADR-019 explicitly mandate the removal of secrets, tokens, and private identifiers from logs, reports, and public outputs.
Capability Inventory: Capabilities are strictly scoped into five workflows (setup, audit, refactor, plan, plan-run). Execution is bounded by approved path allowlists and mandatory pre-write state rechecks.
[DATA_EXPOSURE]: The skill documentation (AC-ADR-004, AC-ADR-012, AC-ADR-019) repeatedly emphasizes the protection of sensitive information. It forbids hardcoding secrets in configuration files and requires that secrets be handled via approved delivery mechanisms, ensuring they never leak into the AI context or public artifacts.
[COMMAND_EXECUTION]: The skill uses established engineering tools such as git, pnpm, and bun to manage the repository and run tests. All command execution is governed by risk-proportional validation policies (AC-ADR-049) and requires explicit authorization for any destructive or high-impact actions.
[EXTERNAL_DOWNLOADS]: The skill references standard public registries (npmjs.com) and well-known technology services (GitHub, Vercel Labs, OpenAI) for dependency management and skill installation. These are handled neutrally as part of the intended engineering workflow and do not escalate the risk profile.

architecture-compass