The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data from sources like JIRA and Confluence via the Librarian role, creating a surface for indirect prompt injection.
Ingestion points: references/roles/librarian.md (ingests data from JIRA, Confluence, and arbitrary URLs using the acli and Read tools).
Boundary markers: Data is passed between specialist agents without explicit XML-style or unique string delimiters to isolate untrusted content from instructions.
Capability inventory: Dispatched specialist agents (Developer, System Analyzer) have high-privilege tool access, including Bash for shell execution and Write for file system modifications.
Sanitization: Ingested content is curated by the Librarian but not explicitly filtered or sanitized to remove potential instructional injection before processing by downstream agents.
[COMMAND_EXECUTION]: The System Analyzer role is designed to investigate live systems using kubectl, psql, argocd, and docker commands via the Bash tool. These operations are intended diagnostic features for non-local environments (SIT/UAT/PROD) and are governed by strict safety gates (SA1-SA5) that mandate read-only access, query limits, and masking of sensitive credentials in the output (references/roles/system-analyzer.md).
[EXTERNAL_DOWNLOADS]: The design documentation site generated by the skill references the Mermaid.js library from the jsDelivr CDN (assets/_shell.html). This is a legitimate use of a well-known technology service for rendering technical diagrams.
[SAFE]: The skill includes several administrative Python scripts (lint.py, docverify.py, apispeccheck.py) for validating documentation structure and cross-references. These scripts utilize standard libraries and demonstrate no malicious behavior.
[SAFE]: UI components in the assets/ directory contain Thai characters for localized display in the generated documentation. This is consistent with the skill's purpose and does not represent an attempt at obfuscation.

neo