The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by capturing user-supplied feature descriptions from $ARGUMENTS and propagating them through a multi-step subagent pipeline.
Ingestion points: Requirements are gathered in Step 1, stored in .python-dev/01-requirements.md, and later read by the Code Explorer, Backend Architect, Python Developer, Test Automator, and Code Reviewer agents.
Boundary markers: The skill lacks explicit boundary markers or "ignore embedded instructions" delimiters when interpolating the contents of the requirements file into the prompt block for each subagent.
Capability inventory: The orchestrator and its subagents have significant capabilities, including writing/modifying code files, executing Git commands, creating Pull Requests via the GitHub CLI, and managing local directories.
Sanitization: No sanitization or validation of the input requirements is performed before they are used to influence the behavior of the specialized agents.
[COMMAND_EXECUTION]: The skill executes several shell commands and CLI tools to manage the development lifecycle. This includes using git for status checks, staging, and commits, gh for PR creation, and standard shell utilities (mkdir, mv, rmdir) for artifact management. These operations are performed with user-derived parameters (such as the $FEATURE_SLUG), which could be abused if the input contains shell metacharacters.
[DYNAMIC_EXECUTION]: The skill uses a modular architecture where it dynamically invokes other agents based on subagent_type (e.g., programming-skills:test-automator). It assembles complex prompts at runtime by concatenating the outputs of previous steps, creating a chain where malicious instructions in early steps could influence the entire automated workflow.

python-feature-development