The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains multiple instructions designed to bypass the agent's standard interaction and confirmation protocols. Phrases like 'CRITICAL
This skill CANNOT ask questions or request user input', 'All decisions must be made autonomously', and 'Never: Ask user for clarification' are used to force the agent to act without human review, even when facing ambiguous situations or destructive operations.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various git commands, including git checkout, git merge, git commit, and git rm -rf. While expected for conflict resolution, the use of targeted deletion (git rm -rf) combined with the suppression of user confirmation increases the risk of unintended data loss if the agent's logic is flawed or manipulated.
[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to read an external file (openspec/CONSTITUTION.md) and treat it as 'higher-priority project law'. This effectively allows the contents of a file (which may be under the control of a third-party contributor in a PR context) to override the agent's instructions and project logic.
Ingestion points: Reads openspec/CONSTITUTION.md and openspec/changes/<change_id>/proposal.md during execution.
Boundary markers: No delimiters or instructions are provided to distinguish between data and potential malicious commands within these files.
Capability inventory: The agent has the capability to perform git operations, commit changes, and delete specific directories via git rm -rf.
Sanitization: No validation or sanitization is performed on the content of the 'project law' file before the agent adopts its instructions.

cflx-resolve