The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as the codebase and related specifications, which could potentially contain malicious instructions.
Ingestion points: The skill reads indexed codebase context, related specs, and epic context as part of the research action in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially embedded instructions within the ingested data.
Capability inventory: The skill is capable of writing files (research.md, .progress.md) and performing git commits if enabled.
Sanitization: No sanitization or validation of the ingested external content is performed before processing.
[DATA_EXPOSURE]: The skill accesses local project files including .claude/ralph-specum.local.md and .progress.md. This access is necessary for the intended workflow and there is no evidence of exfiltration to external domains.
[COMMAND_EXECUTION]: The skill includes instructions to commit spec artifacts if enabled, which involves executing git commands. This is consistent with the skill's stated purpose of managing a development workflow.

ralph-specum-research