The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes data from external markdown files to generate automated validation criteria.
Ingestion points: The skill reads from specs/requirements/prd.md and specs/requirements/features/<slug>.md.
Boundary markers: While the skill instructs the agent to ignore design.md and openapi.yaml, it lacks explicit boundary markers or instructions to disregard potential commands or malicious patterns embedded within the requirement documents themselves.
Capability inventory: The skill uses the addFile tool to write a validation-criteria.json file to the workspace.
Sanitization: No sanitization or escaping is performed on the text extracted from requirements before it is formatted into the JSON statement and must fields.
[COMMAND_EXECUTION]: The skill utilizes the addFile capability to create or update the validation criteria file in the project workspace. This is the primary intended function but represents a file system write operation.
[NO_CODE]: The skill does not include any standalone scripts or external package dependencies, significantly reducing the surface area for traditional remote code execution or dependency-based attacks.

validation-criteria