The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: The skill ingests "any feature request or bug report in plain words," reads the current "project state," and analyzes the "code that the request touches."
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings mentioned to separate untrusted input from the planning logic.
Capability inventory: The skill possesses significant capabilities, including loading and running other skills via the skill tool, writing to the .scratchpad/ directory, and managing unattended-run sessions that involve building and testing code.
Sanitization: The instructions do not describe any sanitization, escaping, or validation of user-provided requests or analyzed code before they are used to determine the execution plan.
[COMMAND_EXECUTION]: The skill relies on the execution of local scripts and system commands to function.
Evidence: The skill reads output from check_yesyak.py and instructions mention waiting for "test runs and builds" in the same turn, implying the execution of shell commands within the project environment.

yak-pilot