The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the docs/backlog/ directory and follows paths specified in the where frontmatter field to read other files in the repository. This data ingestion could be used to deliver malicious instructions to the agent.
Ingestion points: Reads all files in docs/backlog/*.md and uses the where field (path:line) to verify and read content from other files in the repository.
Boundary markers: None identified. The instructions tell the agent to read the files "in full" and verify the content without specific delimiters to ignore embedded instructions.
Capability inventory: Uses Bash, Write, Edit, Read, and Glob tools across multiple lifecycle operations.
Sanitization: None. The skill does not specify any validation or sanitization of the text contained within the backlog items before the agent processes them.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute various Git commands (git rm, git symbolic-ref, git rev-parse, git branch, git diff). While these are standard repository management tasks, the broad nature of the Bash tool means that if the agent is compromised via prompt injection, this tool could be abused to perform unauthorized actions on the host system.

backlog