The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by processing and storing untrusted input that is intended to be read by the agent later.
Ingestion points: Data is gathered from $ARGUMENTS and the session context in Step 2 (What, Why, Where, etc.).
Boundary markers: While the skill uses Markdown headers and bold keys as structure, it does not include explicit delimiters or instructions to ignore embedded commands within the user-provided content.
Capability inventory: The skill uses Edit and Write tools to modify files and Bash to execute git commands.
Sanitization: There is no mention of sanitizing or escaping the user-controlled strings before they are appended to the .turbo/improvements.md file.
Impact: Malicious instructions embedded in the user's "improvement" description could influence the agent's behavior when it reads the backlog in subsequent work sessions.

note-improvement