The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository documents (Markdown, YAML, JSON, etc.) to determine project status and suggest subsequent tasks. This creates a potential surface for indirect prompt injection where malicious instructions inside project files could influence the agent's recommendations.
Ingestion points: Files in the root, docs/, spec/, and workflow/ directories are scanned during Phase 1.
Boundary markers: The instructions prioritize TRACEABILITY-METADATA blocks but do not include explicit warnings to ignore embedded instructions in the broader document content.
Capability inventory: The skill's capabilities are limited to recommending internal slash commands (e.g., /brd-interviewer), generating Mermaid diagrams, and using the TodoWrite tool for progress tracking. It does not possess high-risk capabilities like arbitrary code execution or external network access.
Sanitization: There is no evidence of explicit sanitization or filtering of the content extracted from repository documents before it is processed by the agent.

guide