The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-supplied input fields.
Ingestion points: User-provided task descriptions and constraints (captured in SKILL.md) are interpolated directly into Phase 1 and Phase 1F prompts within PROMPTS.md using the <TASK> placeholder.
Boundary markers: The templates use textual headers (e.g., TASK: <TASK>) but lack strong delimiters or explicit instructions to the model to ignore or treat the content within those blocks as untrusted data, allowing a malicious task description to potentially hijack subagent behavior.
Capability inventory: The subagents receiving these inputs possess filesystem write capabilities (Phase 4: Implementation) and command execution capabilities (Phase 5: Build Verification), increasing the potential impact of a successful injection.
Sanitization: No sanitization, escaping, or validation is performed on the user input before it is passed to the subagents.
[COMMAND_EXECUTION]: The skill performs shell command execution as part of its core build-and-verify workflow.
Evidence: In Phase 5 (Build Verification) and Phase 6b (Review Fix) in PROMPTS.md, the skill executes cmake --build ./out --config Debug --target Telegram to verify implementation correctness.
Context: While necessary for the skill's stated purpose of automating C++ development tasks, these commands are executed following potentially untrusted plan adjustments made during the implementation phases.

task-think