The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection because it processes external, potentially untrusted requirements data as a core part of its design workflow.
Ingestion points: Untrusted data is ingested from external files including feature-ticket.json, research-report.json, and data-analysis-report.json as specified in the Suggested Process section of SKILL.md.
Boundary markers: The skill instructions do not specify any delimiters or instructions for the agent to disregard potentially malicious commands embedded within these ingested data files.
Capability inventory: The skill is configured with broad system capabilities including write_file, edit_file, create_file, and execute_command as defined in the allowed-tools section of SKILL.md.
Sanitization: There are no instructions for sanitizing, validating, or escaping the content of the requirements files before the agent processes them.

design-ux-flow