The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content from external systems.
Ingestion points: In skill/prompts/prjmx-collect/01-data-collection.md, the skill instructions detail the retrieval of work items, bug descriptions, and Git commit messages, all of which are attacker-controllable sources.
Boundary markers: The prompts do not establish clear boundaries or delimiters to prevent the agent from interpreting instructions that might be embedded within the data retrieved from external APIs.
Capability inventory: The agent is instructed to perform complex reasoning, calculate metrics, and write results to the local file system (work/outputs/), which provides a path for potential exploitation of the agent's logic through injected content.
Sanitization: No explicit sanitization or filtering logic is provided to the agent to handle potentially malicious strings in the analyzed fields.
[EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions for setting up a web frontend, specifically directing the user to run npm install in the frontend/ directory. This involves fetching external dependencies from the public npm registry. While this is a standard development workflow, it introduces third-party code into the execution environment.

project-metrics-orid