The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external tracking systems (e.g., Jira, GitHub Issues), creating an attack surface where malicious instructions embedded in task descriptions could influence the agent's behavior.
Ingestion points: The RESUME and ORIENT steps, detailed in product-state-and-continuity.md and product-ownership-operating-model.md, read state and item details from external trackers using a tracker adapter.
Boundary markers: Absent. While the skill defines a logical "authority boundary" for decision-making, it does not specify technical delimiters (such as XML tags or unique markdown fences) to isolate data retrieved from the tracker within the agent's context.
Capability inventory: The skill possesses the capability to perform file system writes (via the CHECKPOINT protocol in product-state-and-continuity.md) and network/API operations (via the create, update, and close methods of the tracker adapter contract described in product-state-and-continuity.md and delivery-orchestration-and-acceptance.md).
Sanitization: Absent. The instructions do not provide requirements for sanitizing or escaping external strings retrieved from the tracker before the agent processes them.

using-product-management