The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of API contracts (OpenAPI, GraphQL, etc.) and PRDs, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill uses the Glob tool to scan and read PRD documents, boundary confirmations, and existing contracts as specified in Phase 0.2 of the SKILL.md execution checklist.
Boundary markers: The instructions do not define specific delimiters or "ignore instructions" warnings to isolate the untrusted contract content from the agent's core logic.
Capability inventory: The agent has the capability to scan the filesystem (Glob), track progress (TodoWrite), and execute local command-line tools for linting, as detailed in references/automated-checks.md.
Sanitization: There is no evidence of sanitization, escaping, or validation of the contract content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructions facilitate the execution of local command-line interface (CLI) tools for API validation (e.g., spectral, redocly, buf, asyncapi). While the instructions in references/automated-checks.md and references/askuser-templates.md state that these tools must already be installed and that the agent must request user permission via AskUserQuestion before execution, running shell commands based on file paths carries a residual risk of command injection if parameters are not strictly validated.

api-reviewer